A Note on the Influence of a Zero Length Nonce on GCM and GMAC

A Note on the Influence of a Zero Length Nonce on GCM and GMAC Yaobin Shen

arXiv:2608.06061v1 [cs.CR] 6 Aug 2026

School of Informatics, Xiamen University, Xiamen, China yaobin.shen@xmu.edu.cn

Abstract. In this note, we show a simple attack that can recover the hash key of GCM and GMAC by using a zero length nonce. After recovering the hash key, the adversary can forge an arbitrary ciphertext or message as she wants. We note that the ISO/IEC version of GCM and GMAC allows the nonce to be a zero length string, while the NIST version of GCM and GMAC explicitly requires the nonce to be at least one bit. Hence, our attack works for the ISO/IEC version and cannot work for the NIST version. Keywords: GCM · GMAC · Zero length nonce · Key recovery attack · Forgery attack

1

Introduction

The Galois/Counter Mode (GCM) and its specialization GMAC are widely deployed authenticated encryption scheme and message authentication code scheme. They are designed by McGrew and Viega [13], and are based on the counter mode encryption and the polynomial hash function. They are specified in many international or national standards, including ISO/IEC [3,2], TLS [6,16], IPSec [18], SSH [10], WIFI (WPA3) [4], NIST [7], IEEE 802.1 [1], and are widely used in practice. The security of GCM has been extensively evaluated from both the provable security side and the cryptanalysis side. McGrew and Viega [13] proved that GCM can achieve security up to 2𝑛/2 data blocks, by assuming that the underlying 𝑛-bit block cipher is a secure PRP. Latex, Iwata et al. [11] pointed out a flaw in the proof and fixed it. Their proof was then improved by Niwa et al. [14] for a better security bound. For the cryptanalysis aspect of GCM, Ferguson [8] showed that forgery attacks and key recovery attacks become easier if the tag length is short. Joux [12] pointed out that a part of the secret key can be recovered if the nonce is reused. Handschuh and Preneel [9] systematically investigated weak keys of universal hash function, including GHASH, a polynomial hash function employed in GCM. The concept of weak keys for polynomial hash function was taken a step further by Saarinen [17] and he showed cycling forgery attacks against GCM by exploiting weak keys. The cycling attacks was extended and formalized by Procter and Cid [15] by introducing the notion of forgery polynomial. Abdelraheem et al. [5] showed a method to construct a forgery polynomial

by using twisted polynomial from Ore rings. Note that none of these attacks violate the security claims for GCM and GMAC. In this note, we show a key recovery attack against GCM and GMAC by using single encryption query with a zero length nonce. This attack can recover the hash key of the polynomial hash function GHASH. With the knowledge of this hash key, the adversary can arbitrarily forge a ciphertext against GCM or arbitrarily forge a message against GMAC. We note that the ISO/IEC version of GCM and GMAC allows the nonce to be a zero length string, while the NIST version requires the minimal length of a nonce to be 1 bit. Therefore, our attack can apply to the ISO/IEC version and cannot work for the NIST version.

2

Description of GCM and GMAC

The Galois/Counter Mode (GCM) is an authenticated encryption scheme that can be used to encrypt a plaintext and authenticate the resulting ciphertext together with associated data. The message authentication code scheme GMAC can be regarded as a special case of GCM where no plaintext is encrypted and only associated data is authenticated. Hence, in this section, we focus on the description of GCM, as the specification of GMAC can be obtained by putting the plaintext of GCM as an empty string. We introduce some notations in order to describe GCM. Let {0, 1}* be the set of all finite bit strings, and {0, 1}𝑛 the set of 𝑛-bit strings. Following the notation in ISO/IEC [3,2], Let the symbol {} be the string with zero length. The set of 𝑛-bit strings {0, 1}𝑛 can also be regarded as GF(2𝑛 ), the finite field with 2𝑛 elements. Let |𝑋| denote the length of a string 𝑋. 𝑋0* denotes the padding that appended with as few zero bits so that the length of string to be a multiple of 𝑛. For a string 𝑋 and an integer 𝑟 with |𝑋| ≥ 𝑟, let msb𝑟 (𝑋) be the string containing only the leftmost 𝑟 bits of string 𝑋, and lsb𝑟 (𝑋) be the string containing only the rightmost 𝑟 bits of 𝑋. For non-negative integers 𝑖 and 𝑟 with 𝑖 ≤ 2𝑟 − 1, let str𝑟 (𝑖) be the 𝑟-bit binary representation of an integer 𝑖. Let int(𝑋) be the non-negative integer representation of a string 𝑋. Concatenation of two strings 𝑋 and 𝑌 is written as 𝑋 ‖ 𝑌 . For a string 𝑋 ∈ {0, 1}* , let 𝑋1 ‖ 𝑋2 ‖ . . . ‖ 𝑋𝑥−1 ‖ 𝑋𝑥* ←𝑛 𝑋 that divides 𝑋 into 𝑛-bit blocks with the exception of the last block, where |𝑋𝑖 | = 𝑛 and 1 ≤ |𝑋𝑥* | ≤ 𝑛. Let 𝐸 : {0, 1}𝑘 × {0, 1}𝑛 → {0, 1}𝑛 be a block cipher. Let 𝐸𝐾 (𝑋) be the block cipher encryption of the value 𝑋 ∈ {0, 1}𝑛 with the key 𝐾 ∈ {0, 1}𝑘 . Let 𝑋 · 𝑌 be the multiplication of two elements 𝑋, 𝑌 ∈ GF(2𝑛 ), 𝑋 ⊕ 𝑌 the addition of 𝑋 and 𝑌 . The authenticated encryption and decryption algorithms of GCM make use of a universal hash function called GHASH. It takes as inputs a 𝑛-bit key, two arbitrary length strings, and gives a 𝑛-bit string as output. Given a 𝑛-bit key 𝐻, two arbitrary length (possibly empty) strings 𝐴 and 𝐶, where 𝐴1 ‖𝐴2 ‖ . . . ‖𝐴𝑎−1 ‖𝐴*𝑎 ←𝑛 𝐴 and 𝐶1 ‖ 𝐶2 ‖ . . . ‖ 𝐶𝑐−1 ‖ 𝐶𝑐* ←𝑛 𝐶, GHASH(𝐻, 𝐴, 𝐶) is the 𝑛-bit value 𝑋𝑎+𝑐+1 that is defined as follows: (i) 𝑋0 = 0𝑛 (ii) 𝑋𝑖 = (𝑋𝑖−1 ⊕ 𝐴𝑖 ) · 𝐻, 1 ≤ 𝑖 ≤ 𝑎 − 1 2

(iii) 𝑋𝑎 = (𝑋𝑎−1 ⊕ 𝐴𝑎 0* ) · 𝐻 (iv) 𝑋𝑖 = (𝑋𝑖−1 ⊕ 𝐶𝑖−𝑎 ) · 𝐻, 𝑎 + 1 ≤ 𝑖 ≤ 𝑎 + 𝑐 − 1 (v) 𝑋𝑎+𝑐 = (𝑋𝑎+𝑐−1 ⊕ 𝐶𝑐 0* ) · 𝐻 (vi) 𝑋𝑎+𝑐+1 = (𝑋𝑎+𝑐 ⊕ str𝑛/2 (|𝐴|) ‖ str𝑛/2 (|𝐶|)) · 𝐻 We can now define the authenticated encryption algorithm of GCM. It takes as inputs a secret key 𝐾, a variable length nonce 𝑁 which shall be distinct for every message, a plaintext 𝑀 , and associated data 𝐴, and gives as outputs a ciphertext 𝐶 and a tag 𝑇 . Here the length of a plaintext should be less than or equal to 239 − 256, and the length of associated data should be less than or equal to 264 − 1. The authenticated encryption algorithm is defined as follows: (i) 𝐻 = 𝐸𝐾 (0𝑛 ) (ii) 𝑌0 = 𝑁 ‖ 031 ‖ 1 if |𝑁 | = 96; otherwise 𝑌0 = GHASH(𝐻, {}, 𝑁 ) (iii) For 𝑖 = 1, 2, . . . , 𝑚 − 1, do the following two steps: (1) 𝑌𝑖 = inc(𝑌𝑖−1 ); (2) 𝐶𝑖 = 𝑀𝑖 ⊕ 𝐸𝐾 (𝑌𝑖 ). (iv) 𝑌𝑚 = inc(𝑌𝑚−1 ) * * * | (𝐸𝐾 (𝑌𝑚 )) (v) 𝐶𝑚 = 𝑀𝑚 ⊕ msb|𝑀𝑚 (vi) 𝑇 = GHASH(𝐻, 𝐴, 𝐶1 ‖ 𝐶2 ‖ . . . ‖ 𝐶𝑚 ) ⊕ 𝐸𝐾 (𝑌0 ) In the above definition, inc(𝑋) treats the rightmost 32 bits of the string 𝑋 ∈ {0, 1}𝑛 as a non-negative integer, and increments this value modulo 232 . More informally, inc(𝑋) = msb𝑛−32 (𝑋) ‖ str32 (int(lsb32 (𝑋) + 1

mod 232 )) .

Similarly, we can define the authenticated decryption algorithm of GCM. It takes as inputs a secret key 𝐾, a variable length nonce 𝑁 , a ciphertext 𝐶, associated data 𝐴, and gives as its output either the plaintext 𝑀 , or the special symbol ⊥ indicating that its inputs are not authentic. Formally, the authenticated decryption algorithm is defined as follows: (i) 𝐻 = 𝐸𝐾 (0𝑛 ) (ii) 𝑌0 = 𝑁 ‖ 031 ‖ 1 if |𝑁 | = 96; otherwise 𝑌0 = GHASH(𝐻, {}, 𝑁 ) (iii) 𝑇 ′ = GHASH(𝐻, 𝐴, 𝐶1 ‖ 𝐶2 ‖ . . . ‖ 𝐶𝑚 ) ⊕ 𝐸𝐾 (𝑌0 ) (iv) If 𝑇 ′ ̸= 𝑇 , then return ⊥ (v) For 𝑖 = 1, 2, . . . , 𝑚 − 1, do the following two steps: (1) 𝑌𝑖 = inc(𝑌𝑖−1 ); (2) 𝑀𝑖 = 𝐶𝑖 ⊕ 𝐸𝐾 (𝑌𝑖 ). (vi) 𝑌𝑚 = inc(𝑌𝑚−1 ) * * * | (𝐸𝐾 (𝑌𝑚 )) (vii) 𝑀𝑚 = 𝐶𝑚 ⊕ msb|𝑀𝑚 As mentioned above, the specification of GMAC can be obtained by setting the plaintext and the ciphertext of GCM as an empty string {}. The variable length nonce 𝑁 shall be unique for every message, otherwise GCM and GMAC will be vulnerable to the forgery attacks as described by Joux [12]. Note that in NIST version and the original version of GCM and 3

GMAC [7,13], it explicitly requires that the length of a variable length nonce shall be between 1 and 2𝑛/2 − 1, while there is no such restriction in ISO/IEC version [3,2]. In ISO/IEC 9797-3 [2], it allows the nonce to be of variable length without any requirement on the minimal length of the nonce. Hence, naturally it allows the nonce to be the zero length string {}. In ISO/IEC 19772 [3], there is a suggestion on the variable length of the nonce that should be between 1 and 264 . However, this suggestion appears in Appendix A.7 which is only informative and not a mandatory requirement. Although both the message and associate data can be an empty string, until now, we are not aware of any explanation why the nonce should be of length at least 1 bit or what will be the consequence if the nonce is a zero length string.

3

A Zero Length Nonce Attack against GCM and GMAC

In this section, we present an attack to recover the hash key of GCM and GMAC. This attack makes use of the zero length nonce which is allowed in the ISO/IEC version of GCM [3] and GMAC [2]. This attack assumes that the adversary can observe the ciphertext corresponding to a zero length nonce (known ciphertext setting), or is granted the power to choose the nonce and set the nonce to be a zero length string (chosen plaintext setting). Zero length nonce attack. In the ISO/IEC version of GCM and GMAC, they allow a variable length nonce and does not enforce the minimal length of a nonce. Hence, the adversary may observe the ciphertext with a zero length nonce, or is allowed to make a query with a zero length nonce. The attack works as follows. 1. The adversary observes the ciphertext and the tag (𝐶, 𝑇 ) corresponding to an encryption query (𝑁, 𝐴, 𝑀 ) where 𝑁 is a zero length string {}. For the simplicity, assume that both 𝐴 and 𝑀 are of one full-block length, but the attack works for 𝐴 and 𝑀 of arbitrary length. Following the specification of GCM, we have (a) 𝑌0 = GHASH(𝐻, {}, {}) = 0𝑛 · 𝐻 = 0𝑛 (b) 𝑇 = GHASH(𝐻, 𝐴, 𝐶) ⊕ 𝐸𝐾 (0𝑛 ) = GHASH(𝐻, 𝐴, 𝐶) ⊕ 𝐻 = 𝐴 · 𝐻 3 ⊕ 𝐶 · 𝐻 2 ⊕ (str𝑛/2 (𝑛) ‖ str𝑛/2 (𝑛)) · 𝐻 ⊕ 𝐻 2. The above equation (b) is a cubic polynomial where the variable is 𝐻. By solving this equation, the adversary can obtain the hash key 𝐻. 3. After recovering the hash key 𝐻, the adversary can easily mount forgery attacks as follows. – By reusing the zero length nonce 𝑁 = {}, the adversary can then forge an arbitrary tuple of (𝐴′ , 𝐶 ′ , 𝑇 ′ ) satisfying 𝑇 ′ = GHASH(𝐻, 𝐴′ , 𝐶 ′ ) ⊕ 𝐻 . (𝑁, 𝐴′ , 𝐶 ′ , 𝑇 ′ ) is a valid tuple that can pass the authenticated decryption oracle. 4

– The adversary can also forge by using any other observed tuple. Once observed a tuple of (𝑁1 , 𝐴1 , 𝐶1 , 𝑇1 ), she can create an new tuple of (𝐴′ , 𝐶 ′ , 𝑇 ′ ) such that GHASH(𝐻, 𝐴′ , 𝐶 ′ ) ⊕ 𝑇 ′ = GHASH(𝐻, 𝐴1 , 𝐶1 ) ⊕ 𝑇1 . The new tuple (𝑁1 , 𝐴′ , 𝐶 ′ , 𝑇 ′ ) can pass the authenticated decryption oracle. It looks like the confidentiality may also be influenced to some extent. The adversary can collect the encryption of 𝑌0′ via 𝐸𝐾 (𝑌0′ ) = 𝑇 ′ ⊕ GHASH(𝐻, 𝐴′ , 𝐶 ′ ) for each authenticated encryption query. In case that any one of counters used in the counter encryption mode collide with 𝑌0′ and denote by 𝐶𝑖 the corresponding ciphertext block, then the adversary can recover the plaintext via 𝑀𝑖 = 𝐶𝑖 ⊕ 𝑇 ′ ⊕ GHASH(𝐻, 𝐴′ , 𝐶 ′ ). Remarks. We have found that several real-world implementations accept zerolength nonces. To avoid exposing them to potential attacks, we do not identify them here and will notify the affected parties independently whenever possible.

References 1. IEEE Standard for Local and Metropolitan Area Networks Media Access Control (MAC) Security, 2006. 2. Information technology – Security techniques – Message Authentication Codes (MACs) – Part 3: Mechanisms using a universal hash function, 2011. 3. Information Technology — Security Techniques — Authenticated Encryption, 2020. 4. WPA3 Specification Version 3.3, 2024. 5. M. A. Abdelraheem, P. Beelen, A. Bogdanov, and E. Tischhauser. Twisted polynomials and forgery attacks on gcm. In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pages 762–786. Springer, 2015. 6. T. Dierks and E. Rescorla. The transport layer security (tls) protocol version 1.2. Technical report, 2008. 7. M. J. Dworkin. Sp 800-38d. recommendation for block cipher modes of operation: Galois/counter mode (gcm) and gmac. National Institute of Standards & Technology, 2007. 8. N. Ferguson. Authentication weaknesses in gcm. NIST Comment, 2005. 9. H. Handschuh and B. Preneel. Key-recovery attacks on universal hash function based mac algorithms. In Annual International Cryptology Conference, pages 144– 161. Springer, 2008. 10. K. Igoe and J. Solinas. Aes galois counter mode for the secure shell transport layer protocol. Technical report, 2009. 11. T. Iwata, K. Ohashi, and K. Minematsu. Breaking and repairing GCM security proofs. In Advances in Cryptology - CRYPTO 2012 - 32nd Annual Cryptology Conference, Santa Barbara, CA, USA, August 19-23, 2012. Proceedings, pages 31– 49, 2012. 12. A. Joux. Authentication failures in nist version of gcm. NIST Comment, 3, 2006.

5

13. D. A. McGrew and J. Viega. The security and performance of the galois/counter mode (GCM) of operation. In Progress in Cryptology - INDOCRYPT 2004, 5th International Conference on Cryptology in India, Chennai, India, December 20-22, 2004, Proceedings, pages 343–355, 2004. 14. Y. Niwa, K. Ohashi, K. Minematsu, and T. Iwata. Gcm security bounds reconsidered. In International Workshop on Fast Software Encryption, pages 385–407. Springer, 2015. 15. G. Procter and C. Cid. On weak keys and forgery attacks against polynomial-based mac schemes. Journal of Cryptology, 28(4):769–795, 2015. 16. E. Rescorla. The transport layer security (tls) protocol version 1.3. Technical report, 2018. 17. M.-J. O. Saarinen. Cycling attacks on gcm, ghash and other polynomial macs and hashes. In International Workshop on Fast Software Encryption, pages 216–225. Springer, 2012. 18. J. Viega and D. McGrew. The use of galois/counter mode (gcm) in ipsec encapsulating security payload (esp). Technical report, 2005.

6

Related documents

• CVE-2026-25832 — LOW 3.7#823686
• The Use of Galois Message Authentication Code (GMAC) in IPsec ESP and AH#266736
• Mobile cloud computing- Google Cloud Messaging.#953040
• A generalization of the maximum likelihood expectation maximization (MLEM) method: Masked-MLEM#491857
• Experimental certification of the nonlocal advantages of quantum imaginarity#1014215