{"record":{"id":"57d41abfdeb71d59","repo":"golang/go","slug":"cipher-incorrect-tag-size-given-to-gcm","errorCode":null,"errorMessage":"cipher: incorrect tag size given to GCM","messagePattern":"cipher: incorrect tag size given to GCM","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/cipher/gcm.go","lineNumber":205,"sourceCode":"\t}\n\n\t_, err := g.GCM.Open(out[:0], nonce, ciphertext, additionalData)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn ret, nil\n}\n\n// gcmAble is an interface implemented by ciphers that have a specific optimized\n// implementation of GCM. crypto/aes doesn't use this anymore, and we'd like to\n// eventually remove it.\ntype gcmAble interface {\n\tNewGCM(nonceSize, tagSize int) (AEAD, error)\n}\n\nfunc newGCMFallback(cipher Block, nonceSize, tagSize int) (AEAD, error) {\n\tif tagSize < gcmMinimumTagSize || tagSize > gcmBlockSize {\n\t\treturn nil, errors.New(\"cipher: incorrect tag size given to GCM\")\n\t}\n\tif nonceSize <= 0 {\n\t\treturn nil, errors.New(\"cipher: the nonce can't have zero length\")\n\t}\n\tif cipher, ok := cipher.(gcmAble); ok {\n\t\treturn cipher.NewGCM(nonceSize, tagSize)\n\t}\n\tif cipher.BlockSize() != gcmBlockSize {\n\t\treturn nil, errors.New(\"cipher: NewGCM requires 128-bit block cipher\")\n\t}\n\treturn &gcmFallback{cipher: cipher, nonceSize: nonceSize, tagSize: tagSize}, nil\n}\n\n// gcmFallback is only used for non-AES ciphers, which regrettably we\n// theoretically support. It's a copy of the generic implementation from\n// crypto/internal/fips140/aes/gcm/gcm_generic.go, refer to that file for more details.\ntype gcmFallback struct {\n\tcipher    Block","sourceCodeStart":187,"sourceCodeEnd":223,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/cipher/gcm.go#L187-L223","documentation":"newGCMFallback (the generic GCM implementation used when the cipher is not AES) validates that tagSize is within [gcmMinimumTagSize=12, gcmBlockSize=16]. Values outside this range — including the natural-seeming 8 or 32 — are rejected because NIST SP 800-38D only permits final-authentication-tag lengths of 128, 120, 112, 104, 96, 64, and 32 bits, and the Go generic path restricts further to the 96..128-bit subset.","triggerScenarios":"Calling cipher.NewGCMWithTagSize(block, tagSize) with tagSize < 12 or > 16, where block is not *aes.Block (so newGCMFallback runs). On AES the same range is enforced inside gcm.New and surfaces a similar error.","commonSituations":"Trying to shorten the tag to 8 bytes for bandwidth, or extending it to 32 bytes for stronger (but unsupported) authentication; misreading the spec and assuming any positive length works.","solutions":["Use one of {12, 13, 14, 15, 16} for tagSize.","Default to NewGCM (tag size 16) unless you have a measured bandwidth constraint; 12 bytes is the minimum.","If you truly need an 8-byte tag, you are outside GCM's allowed set — use a separate MAC construction."],"exampleFix":"// before\na, err := cipher.NewGCMWithTagSize(block, 8) // \"incorrect tag size\"\n\n// after\na, err := cipher.NewGCMWithTagSize(block, 12) // minimum allowed","handlingStrategy":"validation","validationCode":"func validGCMTagSize(n int) error {\n    const (\n        gcmMinimumTagSize = 12\n        gcmBlockSize      = 16\n    )\n    if n < gcmMinimumTagSize || n > gcmBlockSize {\n        return fmt.Errorf(\"tag size %d outside [%d, %d]\", n, gcmMinimumTagSize, gcmBlockSize)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"a, err := cipher.NewGCMWithTagSize(block, tag)\nif err != nil && strings.Contains(err.Error(), \"incorrect tag size\") {\n    // Fall back to the standard 16-byte tag.\n    a, err = cipher.NewGCM(block)\n}","preventionTips":["Default to NewGCM (16-byte tag) unless bandwidth is measured-critical.","Validate config-driven tag sizes at load time against {12..16}.","Document that 8-byte tags are not supported by Go's GCM."],"tags":["crypto","gcm","argument-validation","tag-size","rfc-strict"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}