Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-07 · high
ISO/IEC's spec allows a zero-length nonce for GCM; NIST's requires at least one bit. Only ISO/IEC-conformant systems are exposed.
Why now: The paper appeared in the August 7 arXiv security lineup, flagging a nonce-length gap between NIST and ISO/IEC's AEAD specs.
A zero-length nonce recovers GCM's hash key, letting an attacker forge ciphertexts that pass authentication, per a new arXiv paper.
Only implementations that follow ISO/IEC's version of the AEAD spec are exposed. ISO/IEC permits an empty nonce; NIST requires at least one bit and blocks the attack outright.
GCM and GMAC both derive their authentication key from the nonce. Feed either one an empty nonce, and that derivation becomes reversible, according to the paper.
Once an attacker holds the recovered key, they can build ciphertexts that pass the algorithm's own authentication check, without ever touching the real key.
It's a short, targeted note, not a break of AES-GCM's underlying math. It hits one specific input: a nonce of zero bits.
Two standards bodies set different minimums for the same primitive, and nothing forces an implementation to pick the stricter one. That's the actual bug. Check whether your AEAD library validates nonce length at the API boundary, instead of trusting that its target spec already forbids zero.
That gap surfaced in the August 7 arXiv security batch, between two standards that set different nonce minimums for the same algorithm.
Each link below shares sources, entities, or timing with this story.
NIST partners with Google DeepMind / Shared entity: NIST / Same source domain / Earlier coverage
Linked by a graph relationship (NIST partners with Google DeepMind); both cover NIST; reported by the same outlet (arxiv.org).
NIST partners with Microsoft / Same source domain / Shared topic / Tension
Linked by a graph relationship (NIST partners with Microsoft); reported by the same outlet (arxiv.org); overlapping topics (against, attack).
Linked by a graph relationship (NIST partners with Microsoft); reported by the same outlet (arxiv.org); overlapping topics (against, attack).
Shared entities / Same source domain / Earlier coverage
Both cover IEC, ISO; reported by the same outlet (arxiv.org); earlier IEC coverage from 2026-08-05.
Shared entity: NIST / Same source domain / Earlier coverage / Tension
Both cover NIST; reported by the same outlet (arxiv.org); earlier NIST coverage from 2026-07-28.
Shared entity: Check / Shared topic / Earlier coverage / Tension
Both cover Check; overlapping topics (against, check); earlier Check coverage from 2026-04-11.
NIST partners with Microsoft
Linked by a graph relationship (NIST partners with Microsoft).
NIST partners with Google DeepMind / Shared topic / Tension
Linked by a graph relationship (NIST partners with Google DeepMind); overlapping topics (against, attack); pushes against this story (against).