CoChat
Sign Up
Cited by 464Cryptographic Implementations and SecurityCoding theory and cryptographyCryptography and Data Security

Recommendation for block cipher modes of operation :

Open access
Dworkin, M J·2007
DOI 10.6028/nist.sp.800-38d
Open this paper in CoChat — free account

Abstract

Reports on Information Security TechnologyThe Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure.ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology.ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems.This Special Publication 800-series reports on ITL's research, guidance, and outreach efforts in computer security, and its collaborative activities with industry, government, and academic organizations.Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately.Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.

AI snapshot

Written from the paper’s full text.

TL;DR

NIST Special Publication 800-38D specifies Galois/Counter Mode (GCM), an authenticated encryption mode constructed from an approved 128-bit block cipher such as AES, together with its authentication-only specialization GMAC. It defines the algorithms, the critical IV/key uniqueness requirement, and constraints on tag lengths and invocation counts.

Key findings

  • GCM combines confidentiality via a variant of Counter mode with authenticity via GHASH, a universal hash over a binary Galois field; input limits are len(P) ≤ 2³⁹−256 bits, len(A) ≤ 2⁶⁴−1 bits, and 1 ≤ len(IV) ≤ 2⁶⁴−1 bits, with all lengths required to be multiples of 8.
  • Supported tag lengths are 128, 120, 112, 104, or 96 bits in general; 64- and 32-bit tags are permitted only under Appendix C constraints. For 32-bit tags, a maximum combined ciphertext+AAD of 2⁵ bytes allows 2²² invocations, down to 2¹⁰ bytes allowing 2¹¹ invocations; for 64-bit tags, 2¹⁵ bytes allows 2³² invocations, down to 2²⁵ bytes allowing 2¹⁷ invocations.
  • The IV uniqueness requirement states the probability that the authenticated encryption function is ever invoked with the same IV and key on two or more distinct input sets shall be no greater than 2⁻³²; a single repeated IV may expose the implementation to forgery attacks (Joux), and the document says this requirement is "almost as important as the secrecy of the key."
  • Unless an implementation uses only 96-bit IVs from the deterministic construction, total invocations of authenticated encryption shall not exceed 2³² across all IV lengths and instances with a given key; a reasonable overall limit of 2⁶⁴ blocks of plaintext and AAD per key is suggested.

Methods

  • This is a standards specification, not an empirical study: it defines Algorithms 1–5 (block multiplication over GF(2¹²⁸), GHASH, GCTR, GCM authenticated encryption, and GCM authenticated decryption), with inputs, outputs, steps, diagrams, and summaries.
  • It specifies requirements for the underlying block cipher (approved, 128-bit block size, key ≥128 bits, fresh and secret), two IV construction frameworks (deterministic and RBG-based), key establishment, and conformance categories (GCM and GMAC).
  • No data, sample, or statistical analysis is reported; the document is normative guidance with appendices summarizing security rationale and short-tag constraints.

Limitations

  • Stated: authentication assurance is "strong, but not absolute" — a targeted ciphertext forgery is expected to succeed with probability approximately n/2ᵗ, where n is the total number of blocks in the GHASH encoding of ciphertext and AAD, so GCM is "not well-suited for use with short tag lengths or very long messages," and each successful forgery increases the probability of subsequent ones and leaks information about the hash subkey H.
  • Stated: GCM does not inherently prevent replay of a valid authenticated-encryption output; the controlling protocol must monitor IV duplication or incorporate identifying information (e.g., sequence numbers, timestamps) into the AAD.
  • Stated: the simplified GHASH in this Recommendation does not obtain all of the properties shown for the designers' definition of GHASH in Ref. [7]; also, security assurance degrades as more data is processed with a single key.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.6028/nist.sp.800-38d

Cites

8 of 8 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 11 cited sources checked · 0 supported · 0 flagged

  • Interpretationreasoning

    An adversary can essentially control the plaintext output of the authenticated decryption function.

    “In other words, the adversary essentially could control the plaintext output of the authenticated decryption function.”
    Quote in the paperSubstantial claim
  • Interpretationnone given

    Independent of the targeted forgery attack, an adversary may attempt to systematically guess many different tags for a given input to authenticated decryption, thereby increasing the probability that one or more will eventually be accepted as valid.

    “Independent of this attack, an adversary may attempt to systematically guess many different tags for a given input to authenticated decryption, and thereby increase the probability that one (or more) of them, eventually, will be accepted as valid.”
    Quote in the paperSubstantial claim
  • Interpretationnone given

    If the authenticated decryption function outputs FAIL, it is certain that at least one of the given inputs (ciphertext, AAD, IV, or tag) is not authentic.

    “If the output is FAIL, then it is certain that at least one of the given inputs (i.e., the ciphertext, the AAD, the IV, or the tag) is not authentic.”
    Quote in the paperSubstantial claim
  • Interpretationreasoning

    Compliance with the uniqueness requirement on IVs is crucial to the security of GCM.

    “Compliance with this requirement is crucial to the security of GCM.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The underlying approved block cipher is secure.
  • Interpretationreasoning

    Each successful targeted forgery leaks information about the hash subkey H.

    “Moreover, each successful forgery in this attack 1) increases the probability that subsequent targeted forgeries will succeed, and 2) leaks information about the hash subkey, H.”
    Quote in the paperSubstantial claim
  • Classified as probably not a substantial claim. 30
  • May combine two claims. 7

  • Classified as probably not a substantial claim.

    Interpretationnone given

    GCM provides assurance of the confidentiality of data using a variation of the Counter mode of operation for encryption.

    “GCM provides assurance of the confidentiality of data using a variation of the Counter mode of operation for encryption.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The underlying approved block cipher is secure.

  • Classified as probably not a substantial claim.

    Premisenone given

    The hash subkey H is generated by applying the block cipher to the zero block.

    “The hash subkey, denoted H, is generated by applying the block cipher to the”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning

    Compliance with the requirements that no two distinct devices share the same fixed field and no two distinct sets of inputs to any single device share the same invocation field implies compliance with the uniqueness requirement on IVs in Sec. 8.

    “Compliance with these two requirements implies compliance with the uniqueness requirement on IVs in Sec. 8.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Interpretationnone given

    GCM can provide authentication assurance for additional data (of practically unlimited length per invocation) that is not encrypted.

    “GCM can also provide authentication assurance for additional data (of practically unlimited length per invocation) that is not encrypted.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The underlying approved block cipher is secure.

  • May combine two claims.

    Interpretationreasoning

    Successful verification of the tag within authenticated decryption gives assurance of authenticity of the data, but the party presenting the input data may not be the original source of the plaintext and AAD.

    “As described in Appendix B, the successful verification of the tag within the authenticated decryption function gives assurance of the authenticity of the data; however, the party that presents the input data to the authenticated decryption function may not be the original source of the plaintext and AAD.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationreasoning

    The GCM functions are relatively efficient and parallelizable; consequently, high-throughput implementations are possible in both hardware and software.

    “Each of these functions is relatively efficient and parallelizable; consequently, high-throughput implementations are possible in both hardware and software.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    Consequently, GCM is not well-suited for use with short tag lengths or very long messages.

    “Consequently, GCM is not well-suited for use with short tag lengths or very long messages.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

    Interpretationreasoning

    For some voice or video applications, short authentication tags can be appropriate because forgery of some fraction of individual authenticated packets may be tolerable.

    “For some voice or video applications, short authentication tags can be appropriate.The forgery of some fraction of the individual authenticated”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The mechanism for the confidentiality of the plaintext within GCM is a variation of the Counter mode, with a particular incrementing function, for generating the necessary sequence of counter blocks.

    “The mechanism for the confidentiality of the plaintext within GCM is a variation of the Counter mode [10], with a particular incrementing function, denoted inc 32 , for generating the necessary sequence of counter blocks.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [10]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    The secure operation of a cryptographic algorithm depends not only on proper implementation of the algorithm's steps but also on adherence to associated requirements.

    “The secure operation of a cryptographic algorithm depends not only on the proper implementation of the steps of the algorithm, but also on the adherence to the associated requirements.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning

    In some protocols an adversary may be able to use data that the verifier itself generated earlier in the protocol.

    “In some protocols an adversary may even be able to use data that the verifier itself generated earlier in the protocol.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationreasoning

    In practice, the requirements in Sec.5.1 should ensure that a key is fresh when it is generated, if the generation mechanism is resistant to tampering.

    “In practice, the requirements in Sec.5.1 should ensure that a key is fresh when it is generated, if the generation mechanism is resistant to tampering.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Premisenone given

    The authentication mechanism within GCM is based on a hash function, called GHASH, that features multiplication by a fixed parameter, called the hash subkey, within a binary Galois field.

    “The authentication mechanism within GCM is based on a hash function, called GHASHfoot_0 , that features multiplication by a fixed parameter, called the hash subkey, within a binary Galois field.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationnone given

    GCM provides stronger authentication assurance than a non-cryptographic checksum or error detecting code; in particular, GCM can detect both accidental modifications of the data and intentional, unauthorized modifications.

    “GCM provides stronger authentication assurance than a (non-cryptographic) checksum or error detecting code; in particular, GCM can detect both 1) accidental modifications of the data and 2) intentional, unauthorized modifications.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The underlying approved block cipher is secure.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisereasoning

    The GHASH function calculates X1•H^m ⊕ X2•H^{m-1} ⊕ ... ⊕ Xm•H.

    “In effect, the GHASH function calculates X 1 •H m ⊕ X 2 •H m-1 ⊕ ... ⊕ X m-1 •H 2 ⊕ X m •H.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    The GCM functions require only the forward direction of the underlying block cipher (i.e., the inverse direction is not required).

    “The GCM functions require only the forward direction of the underlying block cipher (i.e., the inverse direction is not required).”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Premisenone given

    The • operation on pairs of the 2^128 possible blocks corresponds to the multiplication operation for the binary Galois field of 2^128 elements.

    “The • operation on (pairs of) the 2 128 possible blocks corresponds to the multiplication operation for the binary Galois (finite) field of 2 128 elements.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Interpretationreasoning

    In practice, the uniqueness requirement on IVs is almost as important as the secrecy of the key.

    “In practice, this requirement is almost as important as the secrecy of the key.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The underlying approved block cipher is secure.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    The GCM functions are online in the sense that the lengths of the confidential data and the additional, non-confidential data are not required in advance; instead, the lengths can be calculated as the data arrives and is processed.

    “The GCM functions are”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    If some or all of the additional, non-confidential data is fixed, then the corresponding elements of the GCM authentication mechanism can be pre-computed.

    “If some or all of the additional, non-confidential data is fixed, then the corresponding elements of the GCM authentication mechanism can be pre-computed.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationnone given

    GHASH is a keyed hash function but not, on its own, a cryptographic hash function.

    “GHASH is a keyed hash function but not, on its own, a cryptographic hash function.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Interpretationcitation

    For GCM, the requirement for uniqueness of IVs is almost as important as keeping the key secret, although not as obvious.

    “For GCM, the requirement in Sec.5.2.1 for the uniqueness of the IVs is almost as important, although not as obvious.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    If the authenticated decryption function outputs the plaintext, the design of GCM provides strong, but not absolute, assurance that the purported source created the tag and that the plaintext, AAD, IV, and tag are authentic and were not subsequently altered.

    “If the output is the plaintext, then the design of the mode provides strong, but not absolute, assurance that the purported source of the data created the tag, i.e., that the plaintext and the AAD (and the IV and the tag) are authentic.Consequently, the mode also provides strong assurance that this information was not subsequently altered, either intentionally or unintentionally.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    GCM keys may be established using the key derivation functions of Transport Layer Security, Internet Key Exchange v1 and v2, and Secure Shell, as allowed in [9].

    “For example, GCM keys may be established using the key derivation functions of the following protocols as allowed in [9]: Transport Layer Security, Internet Key Exchange v1 and v2, and Secure Shell.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [9]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given

    The authenticity of the protected data can be verified independently from the recovery of the confidential data from its encrypted form.

    “The authenticity of the protected data can be verified independently from the recovery of the confidential data from its encrypted form.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    GCM does not employ the inverse cipher function.

    “GCM does not employ the inverse cipher function.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    Eventually, the hash subkey H may be compromised entirely, with the consequence that authentication assurance is completely lost.

    “Eventually, H may be compromised entirely, with consequences as described at the end of Appendix A: the authentication assurance is completely lost.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Premisenone given

    If an adversary chooses a t-bit tag at random, it is expected to be correct for given data with probability 1/2^t.

    “As with any tag-based authentication mechanism, if the adversary chooses a t-bit tag at random, it is expected to be correct for given data with probability 1/2 t .”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    If the unique initialization string is predictable, and the length of the confidential data is known, then the block cipher invocations within the GCM encryption mechanism can be pre-computed.

    “If the unique initialization string is predictable, and the length of the confidential data is known, then the block cipher invocations within the GCM encryption mechanism can be pre-computed.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Interpretationnone given

    The security assurance of GCM degrades as more data is processed with a single key.

    “Moreover, as with most block cipher modes of operation, the security assurance of GCM degrades as more data is processed with a single key.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Interpretationnone given

    The creation of an authentication tag by the authenticated encryption function provides the mechanism whereby assurance of the authenticity of the plaintext and AAD (and IV) can be obtained upon execution of the authenticated decryption function.

    “The creation of an authentication tag by the authenticated encryption function provides the mechanism whereby assurance of the authenticity of the plaintext and AAD (and IV) can be obtained upon the execution of the authenticated decryption function.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning

    One potential advantage of the RBG-based construction is that the RBG may be designed to recover from a loss of power without requiring action from the IT professional that maintains the system.

    “One potential advantage of the RBG-based construction is that the RBG may be designed to recover from a loss of power in a straightforward manner, i.e., without requiring action from the IT professional that maintains the system.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    Compliance with the uniqueness requirement on IVs, and hence the security of GCM, ultimately depends on the IT professional who configures, deploys, and maintains the GCM modules within a particular system.

    “Compliance with the uniqueness requirement on IVs, and hence the security of GCM, ultimately depends on the IT professional who configures, deploys, and maintains the GCM modules within a particular system.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning

    For the deterministic construction, all deterministic elements necessary to construct the IV would have to be available when power is restored.

    “For the deterministic construction, all of the deterministic elements that are necessary to construct the IV would have to be available when power is restored.”
    Quote in the paperNot a substantial claim
34 of 34

  • The paper relies on this without support.

    The underlying approved block cipher is secure.

    “GCM is constructed from an approved symmetric key block cipher with a block size of 128 bits, such as the Advanced Encryption Standard (AES) algorithm that is specified in Federal Information Processing Standard (FIPS) Pub.197 [2].”
1 of 1

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • To eliminate the risk of nonce reuse, the framework employs a stochastic generation approach compliant with NIST SP 800-38D guidelines.

    “To eliminate the risk of nonce reuse, the framework employs a stochastic generation approach compliant with NIST SP 800-38D guidelines (Dworkin, 2007).”

    From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Dworkin, 2007

    Section 8.2 describes an approved random-bit-generator construction for GCM IVs, supporting the use of a stochastic approach under NIST SP 800-38D. But Section 8 defines the uniqueness requirement as a probability of nonce reuse no greater than 2^-32, not zero; the source does not support the claim that this approach eliminates the risk. (LLM, conf=0.90)

    Experimental — accuracy not yet measured

  • Archives approaching N ∼ 2^32 files per key fall into the regime where NIST SP 800-38D §8.3 recommends key rotation; the framework supports this through the explicit key reference required by every encryption operation.

    “Archives approaching N ∼ 2 32 files per key fall into the regime where NIST SP 800-38D §8.3 recommends key rotation; our framework supports this through the explicit key reference required by every encryption operation.”

    From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Dworkin, 2007

    Section 8.3 limits authenticated-encryption invocations to 2^32 per key for the specified IV constructions, so changing keys before that limit is a reasonable operational implication. It does not state a limit in files, and the 2^32 cap does not apply to implementations using only deterministically generated 96-bit IVs. The statement about the citing authors’ framework is their own, not a claim attributed to NIST. (LLM, conf=0.88)

    Experimental — accuracy not yet measured

  • AES-GCM is specified by NIST SP 800-38D (Dworkin, 2007) as an approved AEAD mode, whereas CTR + HMAC, although built from approved primitives, is not itself a standardized AEAD construction.

    “Third, standardization: AES-GCM is specified by NIST SP 800-38D (Dworkin, 2007) as an approved AEAD mode, whereas CTR + HMAC, although built from approved primitives, is not itself a standardized AEAD construction.”

    From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Dworkin, 2007

    The Introduction specifies GCM for authenticated encryption with associated data and identifies AES as a block cipher on which it can be built, supporting the AES-GCM portion of the claim. The paper does not address whether CTR + HMAC is a standardized AEAD construction or establish the approval status of both of its primitives. (LLM, conf=0.88)

    Experimental — accuracy not yet measured

  • The framework implements the AES-128-GCM standard.

    “The framework implements the AES-128-GCM standard (Dworkin, 2007).”

    From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Dworkin, 2007

  • The security of AES-GCM mode relies strictly on the uniqueness of the initialization vector for a given key.

    “The security of the AES-GCM mode relies strictly on the uniqueness of the initialization vector for a given key.”

    From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Dworkin, 2007

Cites

Flagged first, then by citations

Research works printed but not linked: 1

  1. IEEE P1619.1™/D23, Draft Standard for Authenticated Encryption with Length Expansion for Storage Devices.

Cited by

Sorted by citations

Related

Authors
Dworkin, M. J.
Publisher
National Institute of Standards and Technology
Published
2007
DOI
10.6028/nist.sp.800-38d
OpenAlex
W2727655671
Semantic Scholar
e140766a2342c14037d83524d339e500e812589f
Cited by
463
References
8
Citations by year
2026: 80 · 2025: 31 · 2024: 25 · 2023: 27 · 2022: 19 · 2021: 28 · 2020: 27 · 2019: 33 · 2018: 24 · 2017: 24 · 2016: 18 · 2015: 29 · 2014: 27 · 2013: 13 · 2012: 15
Type
report
Language
en
Open access
Licence
public-domain
Funders
  • Government of Canada
  • National Institute of Standards and Technology
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
  • Physical Sciences › Computer Science › Artificial Intelligence › Coding theory and cryptography
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
Keywords
block cipher, modes of operation, cryptographic standards, block cipher modes of operation

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-20.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-20.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review