Take the 2-minute tour ×  When setting up a nonce/IV and counter
(e.g. for AES-GCM-128), why are the nonce/IV and counter
restricted to specific sections (e.g. random nonce/IV in first 8
bytes and counter in last 8 bytes)? This results in the last 8
bytes always starting off at a predictable value (0), reduces
uniqueness (only 8 bytes of random data), and requires more
frequent re-keying due to counter wrapping.  Is there a reason
the entire 16 bytes cannot be initialized to random data, start
the counter from there, and allow the counter to use the entire
16 bytes?  share|improve this question Where did you read that
the counter section is 8 bytes and only 8 bytes? –  mikeazo Jul
3 '13 at 14:45 In the case of nonce we don't really care about
predictability, we only require it to be a value that doesn't
repeat throughout the session. Yes many crypto software start
their nonces at 0. I don't recall any schemes having specific IV
size limits, maybe I'm missing something? –  rath Jul 3 '13 at
14:54 @rath That is