> If it is not 96 bits, then the value is first hashed with GHASH, GCM’s universal hash function, and the full 128-bit output becomes the initial counter value: [---] However, we can’t just assume that the output of GHASH is ideal with respect to collisions
They already special-cased 96 bits, so couldn't they have special-cased 128 bits to be direct addition, without concatenation?
Sure, they could have - but didn't. Probably because they were strongly biased toward nonces being generated by a counter, and separating an external 'message counter' from the internal 'block counter' is a nice scheme to have essentially unlimited, large messages without any concern for nonce reuse.
Except for subsequent experiences showing us that reliably keeping track of a counter can be a lot harder than it first appears, hence the attractiveness of randomized nonces.
They already special-cased 96 bits, so couldn't they have special-cased 128 bits to be direct addition, without concatenation?