Minimum plaintext length for AES-GCM In AES-GCM, from what i understand, the plaintext(as well as AAD and IV) bit length taken in must be a multiple of 8 (as specified by NIST Spes. Pub 800-38D). The AES-CTR however, doesn't "care" about the bit length.

The majority of my confusion comes from looking at how the AES-GCM works as a whole. It seems to me that to appropriately generate an authentication tag it needs two strings of plaintext. Additionally , the GHASH function seems to take in n 128-bit ciphertext strings.

Which leaves me with the question: What is the minimum amount of plaintext data required(after any padding) to appropriately encrypt and authenticate using AES-GCM?
The original proposal specifies:


  A plaintext $P$, which can have any number of bits between 0 and $2^{39} − 256$.


The NIST SP 800-38D specifies:


  Although GCM is defined on bit strings, the bit lengths of the plaintext, the AAD, and the IV shall all be multiples of 8, so that these values are byte strings.


So there is a clear difference between the original proposal and 38D. I presume that this is because the test vectors almost never contain any tests for plaintext (or AAD, IV and authentication tag) that are not a multiple of 8 bits. In that case it is probably better to leave it out.

So onto your question:


  What is the minimum amount of plaintext data required (after any padding) to appropriately encrypt and authenticate using AES-GCM?


Well, zero bits, obviously. GCM doesn't require any padding of the plaintext before it is used within the algorithm. Steps 4 &amp; 5 in 7.1 of 38D define how the input is padded before it is used. Although the specification is limited to accepting bytes, there is nothing stopping you from creating an implementation that operates on bits.