{"record":{"id":"e8a6ec11abe1153b","repo":"golang/go","slug":"crypto-aes-gcm-tag-and-nonce-sizes-can-t-be-non-s","errorCode":null,"errorMessage":"crypto/aes: GCM tag and nonce sizes can't be non-standard at the same time","messagePattern":"crypto/aes: GCM tag and nonce sizes can't be non-standard at the same time","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/boring/aes.go","lineNumber":223,"sourceCode":"const (\n\tgcmBlockSize         = 16\n\tgcmTagSize           = 16\n\tgcmStandardNonceSize = 12\n)\n\ntype aesNonceSizeError int\n\nfunc (n aesNonceSizeError) Error() string {\n\treturn \"crypto/aes: invalid GCM nonce size \" + strconv.Itoa(int(n))\n}\n\ntype noGCM struct {\n\tcipher.Block\n}\n\nfunc (c *aesCipher) NewGCM(nonceSize, tagSize int) (cipher.AEAD, error) {\n\tif nonceSize != gcmStandardNonceSize && tagSize != gcmTagSize {\n\t\treturn nil, errors.New(\"crypto/aes: GCM tag and nonce sizes can't be non-standard at the same time\")\n\t}\n\t// Fall back to standard library for GCM with non-standard nonce or tag size.\n\tif nonceSize != gcmStandardNonceSize {\n\t\treturn cipher.NewGCMWithNonceSize(&noGCM{c}, nonceSize)\n\t}\n\tif tagSize != gcmTagSize {\n\t\treturn cipher.NewGCMWithTagSize(&noGCM{c}, tagSize)\n\t}\n\treturn c.newGCM(0)\n}\n\nconst (\n\tVersionTLS12 = 0x0303\n\tVersionTLS13 = 0x0304\n)\n\nfunc NewGCMTLS(c cipher.Block) (cipher.AEAD, error) {\n\treturn c.(*aesCipher).newGCM(VersionTLS12)","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/boring/aes.go#L205-L241","documentation":"Raised by the BoringCrypto AES backend's NewGCM when BOTH nonceSize and tagSize are non-standard simultaneously. BoringCrypto's EVP AEAD path can fall back to the standard library for a non-standard nonce OR a non-standard tag, but not both at once, so the combination is rejected up front.","triggerScenarios":"Calling the internal boring aesCipher.NewGCM(nonceSize, tagSize) with nonceSize != 12 (gcmStandardNonceSize) AND tagSize != 16 (gcmTagSize). User-facing: cipher.NewGCMWithNonceSize combined with a non-standard tag on a boringcrypto build of Go.","commonSituations":"Applications that need SIV/non-12-byte nonces AND truncated/extended GCM tags; misconfigured AEAD wrappers that override both defaults; protocol implementations requiring bespoke GCM parameters under a FIPS/boringcrypto Go toolchain.","solutions":["Keep at least one of nonceSize/tagSize at its standard value (12-byte nonce or 16-byte tag).","If both must be non-standard, use the standard library crypto/aes GCM (non-boring build) or a pure-Go GCM implementation.","Re-evaluate whether both deviations are truly required by the protocol; one of the two is usually fixed.","On a boringcrypto build, fall back is automatic for a single deviation — request only one."],"exampleFix":"// before (boringcrypto build)\naead, err := cipher.NewGCMWithNonceSize(block, 13) // non-standard nonce\ntagAead, _ := cipher.NewGCMWithTagSize(block, 12)   // then non-standard tag elsewhere\n// combining both on one AEAD is rejected\n\n// after\naead, err := cipher.NewGCM(block) // standard 12-byte nonce, 16-byte tag","handlingStrategy":"validation","validationCode":"func checkGCMParams(nonceSize, tagSize int) error {\n    const stdNonce, stdTag = 12, 16\n    if nonceSize != stdNonce && tagSize != stdTag {\n        return errors.New(\"boringcrypto GCM cannot vary nonce and tag size together\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep either nonce at 12 bytes or tag at 16 bytes on boringcrypto builds.","For both non-standard, switch to a non-boring Go build or pure-Go GCM.","Document the boringcrypto AEAD constraints in your config."],"tags":["crypto","aes","gcm","boringcrypto","fips","validation"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}