Note showing zero-length nonces break GCM/GMAC by exposing GHASH key and enabling forgeries, because standards love footguns.
4 comments
zero-length nonce makes y0 = 0, so the tag leaks h.
> zero-length nonce makes y0 = 0, so the tag leaks h.
No, the tag is not just handing you h on a plate. The problem is that a zero-length nonce collapses the pre-counter input into a fixed, attacker-known value, so you get a GHASH equation you can reuse for forgeries, which is uglier than “leaks h”.
Not quite, it's the fixed pre-counter block that turns GHASH into a forgery oracle.
> the ISO/IEC version of GCM and GMAC allows the nonce to be a zero length string
Worth separating the spec bug from the math bug here, because the attack is really on the ISO encoding of the pre-counter block, not on GCM as usually deployed under NIST’s non-empty IV requirement. In practice this is still a nice reminder that “nonce” vs “IV” gets sloppy fast (and an empty one is not just unusual, it changes the algebra).