Key wrapping - encrypting many times with AES-GCM When encrypting many short plaintexts with a single key, lets say about 2^64 total plaintexts at under 64 bytes each: (edit note - was 2^70 in the original question)


Is there a way to use AES-GCM, as specified by NIST Special Publication 800-38D, safely in this scenario?
Is is safe to use when there are no IV collisions, e.g when the IV is a counter?
Is it possible to use a larger IV while still adhering to the NIST specs, possibly large enough to collisions even with random IVs?


Does this change if the plaintexts are high-entropy, for example when wrapping keys?
No.  You're well above the birthday bound for a 128-bit block cipher.  Using AES under a single key for more than about $2^{64}$ blocks of data is asking for trouble.

The largest nonce you can use with standard AES-GCM is 96 bits,* which is safe sequentially, but you're probably not doing this sequentially unless you plan to wait a millennium for your sequential computer to count to $2^{70}$.  You could carve up the input space and assign disjoint subsets to an array of computers in parallel, but now you have much larger operational security and scaling issues that you almost certainly need to address first, and most likely the way you address those will be by using more than one key anyway.

Your best bet here is to give more details about what you're actually trying to accomplish, rather than ask how to use AES-GCM far beyond its advertised limits.



* Technically you can use >96-bit nonces with AES-GCM, but that's foolish because it is effectively the same as using random 96-bit nonces, and so it is worse than using sequential 96-bit nonces.