golang/go · error

cipher: NewGCM requires 128-bit block cipher

Error message

cipher: NewGCM requires 128-bit block cipher

What it means

Returned by gcm.New when cipher.BlockSize() != gcmBlockSize (16). GCM is only defined over a 128-bit block cipher, i.e. AES. Passing a non-AES block cipher (e.g. a hypothetical 64-bit block cipher) is rejected at construction.

Source

Thrown at src/crypto/internal/fips140/aes/gcm/gcm.go:39

func New(cipher *aes.Block, nonceSize, tagSize int) (*GCM, error) {
	// This function is outlined to let the allocation happen on the parent stack.
	return newGCM(&GCM{}, cipher, nonceSize, tagSize)
}

// newGCM is marked go:noinline to avoid it inlining into New, and making New
// too complex to inline itself.
//
//go:noinline
func newGCM(g *GCM, cipher *aes.Block, nonceSize, tagSize int) (*GCM, error) {
	if tagSize < gcmMinimumTagSize || tagSize > gcmBlockSize {
		return nil, errors.New("cipher: incorrect tag size given to GCM")
	}
	if nonceSize <= 0 {
		return nil, errors.New("cipher: the nonce can't have zero length")
	}
	if cipher.BlockSize() != gcmBlockSize {
		return nil, errors.New("cipher: NewGCM requires 128-bit block cipher")
	}
	g.cipher = *cipher
	g.nonceSize = nonceSize
	g.tagSize = tagSize
	initGCM(g)
	return g, nil
}

const (
	gcmBlockSize         = 16
	gcmTagSize           = 16
	gcmMinimumTagSize    = 12 // NIST SP 800-38D recommends tags with 12 or more bytes.
	gcmStandardNonceSize = 12
)

func (g *GCM) NonceSize() int {
	return g.nonceSize
}

View on GitHub (pinned to b6b368adc5)

Solutions

1. Ensure the cipher passed in is a real crypto/aes block (aes.NewCipher produces a 16-byte block).
2. In tests, make any stub Block return BlockSize()==16.
3. Construct the AES cipher via aes.NewCipher(key) before passing to NewGCM.

Example fix

// before
aead, err := gcm.New(fakeBlock, 12, 16) // fakeBlock.BlockSize()==8
// after
block, _ := aes.NewCipher(key)
aead, err := cipher.NewGCM(block)

func validGCMBlock(b cipher.Block) bool { return b.BlockSize() == 16 }

block, err := aes.NewCipher(key)
if err != nil { return err }
if !validGCMBlock(block) { return errors.New("GCM requires a 128-bit block cipher") }

// n/a

aead, err := cipher.NewGCM(block)
if err != nil { return fmt.Errorf("gcm init: %w", err) }

When it happens

Trigger: Calling gcm.New(cipher, ...) where cipher is an aes.Block whose BlockSize() is not 16; in practice this fires when the constructor is wired to a malformed or stub Block implementation.

Common situations: Unit tests with a fake/mock block cipher that returns the wrong BlockSize; future 256-bit-block ciphers passed through the same constructor; corruption of the aes.Block wrapper.

Related errors

• cipher: incorrect tag size given to GCM
• cipher: the nonce can't have zero length
• crypto/cipher: incorrect nonce length given to SetNoncePrefi
• crypto/aes: GCM tag and nonce sizes can't be non-standard at
• cipher: message authentication failed

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/9cbe975cdc23da1f. Report an issue: GitHub.