How are long IVs used in AES-GCM?

Question

I looked through NIST's official test vectors (CAVP) for the AES-GCM mode, and noticed that there are some test vectors in there with 8-bit or 1024-bit IVs. But as far as I understand, the GCM guideline specifically insists on using 96-bit IVs.

I took a glance at the SP 800-38D and found no clear guidelines on using these kinds of IVs. Section 8.2, which is dedicated to IV construction, says:

suppose that an implementation supports IV lengths of 64 bits, 96 bits, 128 bits, and 160 bits. For 64-bit IVs the only choice is the construction in Sec. 8.2.1. For the other three IV lengths, one possible combination of choices is the construction in Sec. 8.2.1 for 96-bit IVs and the construction in Sec. 8.2.2 for 128-bit and 160-bit IVs.

And section 8.2.2 mentions RBG-based Construction, but it gives no clear guideline on how exactly we are supposed to process a 1024-bit IV. I would appreciate a clear algorithmic guide for such IVs.

Does this answer your question? AES-GCM recommended IV size: Why 12 bytes? another How to choose the size of the IV in AES-GCM? — kelalaka, Oct 02 '22 at 08:22
@kelalaka : I read those questions before posting this. So I guess I wasn't paying enough attention and missed something. Can you point me to the phrase that answered this specific question? — polfosol, Oct 02 '22 at 08:39
It is in the NIST document, however, the first answer on the first link contains how IV is processed if it is not 12 bytes from the NIST doc. What is not clear there? — kelalaka, Oct 02 '22 at 08:43
@kelalaka yes, Danny did answer my question. What I meant was, you don't know it until you know it! — polfosol, Oct 02 '22 at 08:48

score 5 · Accepted Answer · answered Oct 02 '22 at 05:06

The processing of non-96-bit IVs are specified in and as part of the GCM algorithm in section 7. And as anyone can tell, non-96-bit IVs are ultimately compressed to 96-bit, which means they're effectively 96-bit IVs, and this is why most guidelines recommends using only IVs of exactly 96 bits.

How are long IVs used in AES-GCM?

1 Answers1