2 added 572 characters in body

As I know the AES-GCM used a nonce and if the two message has the same nonce then the secret key can be retrieved.

Yes and no. The authentication key can be determined if the same nonce is used for more than 1 unique message, but the encryption key cannot. This means that an attacker could forge messages that would be authentic, but they would not be able to decrypt the data. Since GCM uses CTR, an attacker will also easily determine the XOR of the plaintexts encrypted with the same nonce.

At this point you can basically consider all other messages encrypted with that key as having been encrypted in CTR mode, as the authentication key is leaked and you longer have any way of telling which messages are authentic. All other messages are still confidential though, so it's not nearly as bad as leaking the encryption key.

If two computers use the AES-GCM to encrypt exchange messages, then what is the key's lifetime of AES-GCM

AES-GCM has a message size limit of a little under 64GiB, but the maximum number of messages per key depends on the nonce construction used.

### Deterministic construction

The deterministic construction consists of the concatenation of a fixed field and an invocation field (i.e. a counter). The fixed field is required to be unique per device, and the invocation field is required to be unique for each plaintext that is encrypted on a device.

### Random construction

The random construction uses a CSPRNG to generate a nonce of predetermined length between 96 and 264 - 1 bits.

### Maximum message counts

If using a random construction (which is required to have at least 12 bytes of entropy), the maximum number of messages is 232.

If using a deterministic construction that's not equal to exactly 12 bytes, the maximum number of messages is 232, or 2S, whichever is smaller (where S is the bit length of the counter used in the construction).

For a deterministic construction for a 12 byte nonce, the maximum number of messages is 2S (where again S is the counter size in bits).

Of course, it's best to re-key well before these limits are reached.

As I know the AES-GCM used a nonce and if the two message has the same nonce then the secret key can be retrieved.

Yes and no. The authentication key can be determined if the same nonce is used for more than 1 unique message, but the encryption key cannot. This means that an attacker could forge messages that would be authentic, but they would not be able to decrypt the data. Since GCM uses CTR, an attacker will also easily determine the XOR of the plaintexts encrypted with the same nonce.

At this point you can basically consider all other messages encrypted with that key as having been encrypted in CTR mode, as the authentication key is leaked and you longer have any way of telling which messages are authentic. All other messages are still confidential though, so it's not nearly as bad as leaking the encryption key.

If two computers use the AES-GCM to encrypt exchange messages, then what is the key's lifetime of AES-GCM

AES-GCM has a message size limit of a little under 64GiB, but the maximum number of messages per key depends on the nonce construction used.

If using a random construction (which is required to have at least 12 bytes of entropy), the maximum number of messages is 232.

If using a deterministic construction that's not equal to exactly 12 bytes, the maximum number of messages is 232, or 2S, whichever is smaller (where S is the bit length of the counter used in the construction).

For a deterministic construction for a 12 byte nonce, the maximum number of messages is 2S (where again S is the counter size in bits).

As I know the AES-GCM used a nonce and if the two message has the same nonce then the secret key can be retrieved.

Yes and no. The authentication key can be determined if the same nonce is used for more than 1 unique message, but the encryption key cannot. This means that an attacker could forge messages that would be authentic, but they would not be able to decrypt the data. Since GCM uses CTR, an attacker will also easily determine the XOR of the plaintexts encrypted with the same nonce.

At this point you can basically consider all other messages encrypted with that key as having been encrypted in CTR mode, as the authentication key is leaked and you longer have any way of telling which messages are authentic. All other messages are still confidential though, so it's not nearly as bad as leaking the encryption key.

If two computers use the AES-GCM to encrypt exchange messages, then what is the key's lifetime of AES-GCM

AES-GCM has a message size limit of a little under 64GiB, but the maximum number of messages per key depends on the nonce construction used.

### Deterministic construction

The deterministic construction consists of the concatenation of a fixed field and an invocation field (i.e. a counter). The fixed field is required to be unique per device, and the invocation field is required to be unique for each plaintext that is encrypted on a device.

### Random construction

The random construction uses a CSPRNG to generate a nonce of predetermined length between 96 and 264 - 1 bits.

### Maximum message counts

If using a random construction (which is required to have at least 12 bytes of entropy), the maximum number of messages is 232.

If using a deterministic construction that's not equal to exactly 12 bytes, the maximum number of messages is 232, or 2S, whichever is smaller (where S is the bit length of the counter used in the construction).

For a deterministic construction for a 12 byte nonce, the maximum number of messages is 2S (where again S is the counter size in bits).

Of course, it's best to re-key well before these limits are reached.

1

As I know the AES-GCM used a nonce and if the two message has the same nonce then the secret key can be retrieved.

Yes and no. The authentication key can be determined if the same nonce is used for more than 1 unique message, but the encryption key cannot. This means that an attacker could forge messages that would be authentic, but they would not be able to decrypt the data. Since GCM uses CTR, an attacker will also easily determine the XOR of the plaintexts encrypted with the same nonce.

At this point you can basically consider all other messages encrypted with that key as having been encrypted in CTR mode, as the authentication key is leaked and you longer have any way of telling which messages are authentic. All other messages are still confidential though, so it's not nearly as bad as leaking the encryption key.

If two computers use the AES-GCM to encrypt exchange messages, then what is the key's lifetime of AES-GCM