AES-GCM recommended IV size: Why 12 bytes? When using AES-GCM, a 96-bit IV is generally recommended. Most implementations I've seen also use 96-bit. However, I'm unsure on where this recommendation or convention comes from.

Let's assume a shorter IV is bad. Assuming all other constraints for IV generation are still met, would using a longer IV necessarily have a negative security impact, or severe performance impact without adding any security benefit?

For instance, an answer in Ciphertext and tag size and IV transmission with AES in GCM mode specifically states


  For GCM a 12 byte IV is strongly suggested as other IV lengths will require additional calculations.


I'm very interested in this statement, but I'm unable to find an explanation on these "additional operations" or other security implications of when using a longer IV. The NIST Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC did not clarify this for me.

So is there any specific reason for everyone using 12 bytes, or is everyone just following convention?
From the proposal of GCM (rewritten if statement):


  if $\operatorname{len}(IV) = 96$ then $Y_0 = IV || 0^{31}1$ else 
  $Y_0 = \operatorname{GHASH}(H, \{\}, IV)$.


So there are additional calculations for IV's other than 96 bits. This is why the original proposal has this recommendation:


  96-bit IV values can be processed more efficiently, so that [ed: this] length is recommended for situations in which efficiency is critical.


but also in the security section it is explained that the IV-processing of GCM was not previously taken into account for GHASH:


  Counter mode was suggested in 1979 by Diffie and Hellman [21], and was shown to be secure in a strong, concrete sense by Bellare et. al. [22]. While the proof of security for GCM rests on those proofs, there are some differences. The derivation of the hash key $H$ from the block cipher key $K$, the hashing of the $IV$, and the use of that key for both IV-processing and message authentication are important details.




NIST SP-800 38D has a whole chapter - chapter 8 - dedicated discussing key and IV uniqueness and the maximum number of invocations of GCM.

If the uniqueness of the IV / key combination cannot be met then security of GCM fails catastrophically.

Then again, that goes for any other cipher as well, particularly those build upon CTR mode encryption (which includes GCM, but also EAX, CCM etc.).



My suggestion is that if you've got small but unique IV input that you expand that input yourself to 12 bytes, if possible according to the hints in NIST SP-800-38D: 8.2.1 Deterministic Construction.

If it is not possible to generate a value that is unique and 12 bytes or below then you might want to consider a fully random IV consisting of 12 bytes.