Number message limits of Galois/Counter Mode (GCM) per key

Question

In https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf page 27, it is said that

...the total number of blocks of plaintext and AAD that are protected by invocations of the authenticated encryption function during the lifetime of the key should be limited. A reasonable limit for most applications would be $2^{64}$...

I could not find any reason for this. What will happen if I encrypt more than $2^{64}$ messages with the following settings

1. The same key is used
2. The tag length is 128-bit
3. IV length is 96-bit
4. Unique IV is chosen for each message
5. Each message has less than 2^32 blocks

What is the attack? What is the security level of my setting...

Answer 1

If you encrypt 2⁶⁴ blocks or more than an attacker can forge encrypted data, i.e. you lose authentication.

Also, be careful about how much total data you encrypt with a key (no matter how many unique IVs are used). Schneier, et.al. once recommended that with CBC mode you encrypt at most 2³² blocks, but with CTR mode you could go to 2⁶⁰ or so blocks due to the fact that you didn't have to worry about reusing IVs with CTR mode like you do with CBC mode (birthday problem). However, subsequent research suggests that the limit for CTR mode is the same as CBC mode, see this. However, it depends on how long the data needs to remain secure and your tolerance of risk. If you want to encrypt data for tape and it needs to be secure for 30 years without being re-encrypted you might want to greatly lower than amount to 2²⁰blocks.