In https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf page 27, it is said that
...the total number of blocks of plaintext and AAD that are protected by invocations of the authenticated encryption function during the lifetime of the key should be limited. A reasonable limit for most applications would be $2^{64}$...
I could not find any reason for this. What will happen if I encrypt more than $2^{64}$ messages with the following settings
- The same key is used
- The tag length is 128-bit
- IV length is 96-bit
- Unique IV is chosen for each message
- Each message has less than 2^32 blocks
What is the attack? What is the security level of my setting...