How long is Key lifetime of AES-GCM key?

Question

As I know the AES-GCM used a nonce and if the two message has the same nonce then the secret key can be retrieved. If two computers use the AES-GCM to encrypt exchange messages, then what is the key's lifetime of AES-GCM?

Answer 1

As I know the AES-GCM used a nonce and if the two message has the same nonce then the secret key can be retrieved.

Yes and no. The authentication key can be determined if the same nonce is used for more than 1 unique message, but the encryption key cannot. This means that an attacker could forge messages that would be authentic, but they would not be able to decrypt the data. Since GCM uses CTR, an attacker will also easily determine the XOR of the plaintexts encrypted with the same nonce.

At this point you can basically consider all other messages encrypted with that key as having been encrypted in CTR mode, as the authentication key is leaked and you longer have any way of telling which messages are authentic. All other messages are still confidential though, so it's not nearly as bad as leaking the encryption key.

If two computers use the AES-GCM to encrypt exchange messages, then what is the key's lifetime of AES-GCM

(I assume you're asking how long the lifetime should be)

AES-GCM has a message size limit of a little under 64GiB, but the maximum number of messages per key depends on the nonce construction used.

Deterministic construction

The deterministic construction consists of the concatenation of a fixed field and an invocation field (i.e. a counter). The fixed field is required to be unique per device, and the invocation field is required to be unique for each plaintext that is encrypted on a device.

Random construction

The random construction uses a CSPRNG to generate a nonce of predetermined length between 96 and 2⁶⁴ - 1 bits.

Maximum message counts

If using a random construction (which is required to have at least 12 bytes of entropy), the maximum number of messages is 2³².

If using a deterministic construction that's not equal to exactly 12 bytes, the maximum number of messages is 2³², or 2^S, whichever is smaller (where S is the bit length of the counter used in the construction).

For a deterministic construction for a 12 byte nonce, the maximum number of messages is 2^S (where again S is the counter size in bits).

Of course, it's best to re-key well before these limits are reached.

Answer 2

The answer is in the NIST 800-38D, you can access it from ACM now.

The total number of invocations of the authenticated encryption function shall not exceed 2^32, including all IV lengths and all instances of the authenticated encryption function with the given key.

Note: not the secret key the message can be retrieved.