Search papers, labs, and topics across Lattice.
This paper identifies a vulnerability in the ISO/IEC version of GCM and GMAC, demonstrating that a zero-length nonce can be exploited to recover the hash key. This key recovery allows an adversary to forge arbitrary ciphertexts or messages, posing a significant security risk. The findings highlight a critical difference between the ISO/IEC and NIST standards, emphasizing the need for stricter nonce requirements in cryptographic implementations.
A zero-length nonce can compromise the security of GCM and GMAC, enabling attackers to forge messages by recovering the hash key.
In this note, we show a simple attack that can recover the hash key of GCM and GMAC by using a zero length nonce. After recovering the hash key, the adversary can forge an arbitrary ciphertext or message as she wants. We note that the ISO/IEC version of GCM and GMAC allows the nonce to be a zero length string, while the NIST version of GCM and GMAC explicitly requires the nonce to be at least one bit. Hence, our attack works for the ISO/IEC version and cannot work for the NIST version.
