{"record":{"id":"4412ef5d8c2131ff","repo":"golang/go","slug":"cipher-newgcm-requires-128-bit-block-cipher","errorCode":null,"errorMessage":"cipher: NewGCM requires 128-bit block cipher","messagePattern":"cipher: NewGCM requires 128-bit block cipher","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/cipher/gcm.go","lineNumber":214,"sourceCode":"// gcmAble is an interface implemented by ciphers that have a specific optimized\n// implementation of GCM. crypto/aes doesn't use this anymore, and we'd like to\n// eventually remove it.\ntype gcmAble interface {\n\tNewGCM(nonceSize, tagSize int) (AEAD, error)\n}\n\nfunc newGCMFallback(cipher Block, nonceSize, tagSize int) (AEAD, error) {\n\tif tagSize < gcmMinimumTagSize || tagSize > gcmBlockSize {\n\t\treturn nil, errors.New(\"cipher: incorrect tag size given to GCM\")\n\t}\n\tif nonceSize <= 0 {\n\t\treturn nil, errors.New(\"cipher: the nonce can't have zero length\")\n\t}\n\tif cipher, ok := cipher.(gcmAble); ok {\n\t\treturn cipher.NewGCM(nonceSize, tagSize)\n\t}\n\tif cipher.BlockSize() != gcmBlockSize {\n\t\treturn nil, errors.New(\"cipher: NewGCM requires 128-bit block cipher\")\n\t}\n\treturn &gcmFallback{cipher: cipher, nonceSize: nonceSize, tagSize: tagSize}, nil\n}\n\n// gcmFallback is only used for non-AES ciphers, which regrettably we\n// theoretically support. It's a copy of the generic implementation from\n// crypto/internal/fips140/aes/gcm/gcm_generic.go, refer to that file for more details.\ntype gcmFallback struct {\n\tcipher    Block\n\tnonceSize int\n\ttagSize   int\n}\n\nfunc (g *gcmFallback) NonceSize() int {\n\treturn g.nonceSize\n}\n\nfunc (g *gcmFallback) Overhead() int {","sourceCodeStart":196,"sourceCodeEnd":232,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/cipher/gcm.go#L196-L232","documentation":"GCM (Galois/Counter Mode) is mathematically defined only for block ciphers with a 128-bit (16-byte) block. This fallback code path runs when the cipher does not implement the gcmAble interface (i.e. no hardware/assembly acceleration) and its BlockSize() is not gcmBlockSize (16). AES in all key sizes has 128-bit blocks, so it passes; ciphers like Blowfish (64-bit) do not.","triggerScenarios":"Calling cipher.NewGCM(block) (which routes to newGCMFallback when the cipher is not gcmAble) with a Block whose BlockSize() != 16. Concretely: wrapping a blowfish.NewCipher block, a Twofish-style 128-bit block that lacks gcmAble implementation details aside, or any custom cipher.Block returning a non-16 BlockSize.","commonSituations":"Selecting GCM as the AEAD over a legacy or non-AES block cipher; writing a custom Block implementation; migrating code that paired GCM with an unexpected cipher; assuming GCM works with any cipher.","solutions":["Use an AES block cipher: block, err := aes.NewCipher(key) then cipher.NewGCM(block).","If you must use a 64-bit block cipher, choose a different AEAD construction (e.g. CTR mode + HMAC) instead of GCM.","Guard before calling NewGCM: verify block.BlockSize() == 16 and surface a clear error otherwise."],"exampleFix":"// before\nblock, _ := blowfish.NewCipher(key)\ngcm, _ := cipher.NewGCM(block)\n// after\nblock, _ := aes.NewCipher(key) // AES has a 128-bit block\ngcm, _ := cipher.NewGCM(block)","handlingStrategy":"validation","validationCode":"// Guard before NewGCM for any non-AES or custom cipher:\nfunc newGCM(block cipher.Block) (cipher.AEAD, error) {\n    if block.BlockSize() != 16 {\n        return nil, fmt.Errorf(\"GCM needs a 128-bit block cipher, got %d-byte blocks\", block.BlockSize())\n    }\n    return cipher.NewGCM(block)\n}","typeGuard":"func isAESBlockSize(b cipher.Block) bool { return b.BlockSize() == 16 }","tryCatchPattern":null,"preventionTips":["Always pair GCM with AES (aes.NewCipher); document this invariant at the call site.","For custom cipher.Block implementations, assert BlockSize()==16 in a unit test.","Avoid passing legacy 64-bit block ciphers (Blowfish, DES) into NewGCM."],"tags":["crypto","gcm","aes","cipher","go"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}