A Zero-Length Nonce Recovers the GCM Hash Key — and the ISO/IEC Spec Allows It While NIST Doesn't
arXiv 2608.06061·high signal
arXiv 2608.06061 (Aug 6) is a short note showing that passing a zero-length nonce to GCM or GMAC lets an adversary recover the hash key, after which they can forge arbitrary ciphertexts or messages. The split matters: the ISO/IEC version of GCM/GMAC permits a zero-length nonce string, while the NIST version explicitly requires at least one bit, so the attack lands on ISO/IEC-conformant implementations only. Anyone shipping an AEAD layer should check whether their library validates nonce length rather than trusting the spec they built against.