💻 computer science

A Note on the Influence of a Zero Length Nonce on GCM and GMAC

This paper presents a simple attack that recovers the hash key of GCM and GMAC when a zero-length nonce is used, enabling arbitrary forgery, a vulnerability specific to the ISO/IEC standard that permits such nonces but not the NIST version which mandates a minimum length.

Original authors: Yaobin Shen

Published 2026-08-07

📖 3 min read☕ Coffee break read

CC BY 4.0

Original authors: Yaobin Shen

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the digital world as a bustling city where every message sent is like a sealed letter. To keep these letters safe, we use special locks called encryption, and to make sure no one has tampered with them, we attach a unique wax seal called a "tag." One of the most popular ways to do this is a system called GCM (Galois/Counter Mode). Think of GCM as a high-tech post office that not only locks your letter but also stamps it with a mathematical fingerprint. This fingerprint is created using a secret "hash key," a special number known only to the sender and receiver. If the fingerprint matches when the letter arrives, everyone knows it's genuine. If the fingerprint is wrong, the letter is rejected. This system is used everywhere, from your Wi-Fi to secure banking, so keeping the secret hash key safe is crucial. If a bad actor steals that key, they could forge their own letters, tricking the post office into thinking they are real.

A recent note by researcher Yaobin Shen explores a very specific, somewhat unusual loophole in how this system is sometimes set up. The paper focuses on a tiny detail: the "nonce." In the world of GCM, the nonce is like a unique serial number or a one-time password that must be different for every single letter sent. It ensures that even if you send the same message twice, the lock and the seal look completely different. The paper investigates what happens if someone accidentally—or intentionally—uses a "zero-length" nonce, which is essentially an empty box with nothing inside it. While some official rulebooks for this system (specifically the ISO/IEC versions) allow for this empty box, others (like the NIST version) strictly forbid it, demanding at least a tiny bit of data. Shen's work shows that if you follow the rules that allow the empty box, a clever attacker can use that empty box to break the math behind the seal.

The paper demonstrates a clever trick where an attacker, by simply observing a message encrypted with this empty nonce, can solve a complex mathematical puzzle to recover the secret hash key. It's like if a thief noticed that when you locked a door with an empty keyhole, the lock clicked in a way that revealed the shape of the master key. Once the attacker has this key, they can forge any message they want. They can create fake letters with perfect seals that the system will accept as real. The author notes that this attack works specifically against the versions of the system that allow the empty nonce, but it fails completely against the versions that require a non-empty one. The paper doesn't just suggest this might happen; it provides a clear, step-by-step method showing exactly how the math breaks down in this specific scenario, proving that the "empty box" is a dangerous weakness in certain implementations.

Technical Summary: A Note on the Influence of a Zero Length Nonce on GCM and GMAC

Problem Statement
The paper addresses a specific vulnerability in the Galois/Counter Mode (GCM) and its specialization, GMAC, arising from the handling of zero-length nonces. While GCM and GMAC are widely deployed authenticated encryption and message authentication code schemes, their security specifications differ between standards. The NIST version explicitly mandates that a nonce must be at least one bit long. In contrast, the ISO/IEC versions (specifically ISO/IEC 9797-3 and ISO/IEC 19772) allow the nonce to be a variable-length string without enforcing a minimum length, thereby permitting a zero-length string (denoted as $\{\}$ ). The author investigates the security consequences of utilizing this zero-length nonce within the ISO/IEC framework.

Methodology
The paper presents a key recovery attack that exploits the mathematical properties of the GHASH function when the nonce is empty. The attack operates under two scenarios: a chosen-plaintext setting (where the adversary can query the encryption oracle with a zero-length nonce) or a specific known-ciphertext setting where the adversary observes a valid encryption corresponding to a zero-length nonce.

The attack proceeds as follows:

Initialization: When the nonce $N$ is a zero-length string, the initialization vector $Y_0$ is computed as $GHASH(H, \{\}, \{\})$ . According to the GHASH definition, this results in $0^n \cdot H$ , which equals $0^n$ .
Tag Generation: The authentication tag $T$ is generated as $T = GHASH(H, A, C) \oplus E_K(Y_0)$ . Since $Y_0 = 0^n$ , $E_K(Y_0)$ becomes $E_K(0^n)$ , which is defined as the hash key $H$ .
Equation Formulation: The tag equation simplifies to $T = GHASH(H, A, C) \oplus H$ . Given that $A$ (associated data) and $C$ (ciphertext) are known, and $T$ is observed, this equation becomes a cubic polynomial in terms of the unknown variable $H$ (the hash key).
Key Recovery: By solving this cubic polynomial, the adversary can recover the hash key $H$ .
Forgery: Once $H$ is recovered, the adversary can forge arbitrary ciphertexts and tags for any associated data and message pairs, provided they reuse the zero-length nonce. Furthermore, the adversary can forge messages using any previously observed nonce by satisfying the linear relation $GHASH(H, A', C') \oplus T' = GHASH(H, A_1, C_1) \oplus T_1$ .

The paper also notes a potential partial impact on confidentiality. If the recovered hash key allows the adversary to compute $E_K(Y'_0)$ for a forged query, and if a counter collision occurs between $Y'_0$ and a counter used in the encryption of a different message, the adversary could recover the corresponding plaintext block.

Key Contributions and Results

Attack Vector: The paper demonstrates a simple, practical attack that recovers the secret hash key $H$ of GCM/GMAC using a single encryption query with a zero-length nonce.
Standard Discrepancy: The work highlights a critical divergence between the NIST and ISO/IEC specifications. The attack is effective only against implementations adhering to the ISO/IEC standard, which permits zero-length nonces, and is ineffective against NIST-compliant implementations which enforce a minimum nonce length of 1 bit.
Consequences: Recovery of the hash key leads to a total break of the authentication mechanism, allowing for the forgery of arbitrary ciphertexts (in GCM) or messages (in GMAC).

Significance and Claims
The paper claims to show that the allowance of zero-length nonces in the ISO/IEC specification creates a vulnerability that compromises the security of GCM and GMAC. The significance lies in the fact that this attack recovers the internal hash key, a fundamental component of the scheme's security, using a minimal amount of data (a single query).

The author maintains a modest tone regarding the scope of the attack, explicitly stating that it applies only to the ISO/IEC version and cannot work for the NIST version. The paper does not claim to break the underlying block cipher or the general security of GCM when used with nonces of length $\ge 1$ bit. Instead, it serves as a warning regarding specific parameter choices in the ISO/IEC standard. The author notes that several real-world implementations appear to accept zero-length nonces but refrains from identifying them publicly to avoid immediate exploitation, opting instead to notify affected parties independently.

Technical Summary: A Note on the Influence of a Zero Length Nonce on GCM and GMAC

More like this