Zero-length nonce lets attackers forge GCM ciphertexts

A zero-length nonce recovers GCM's hash key, letting an attacker forge ciphertexts that pass authentication, per a new arXiv paper.

Only implementations that follow ISO/IEC's version of the AEAD spec are exposed. ISO/IEC permits an empty nonce; NIST requires at least one bit and blocks the attack outright.

GCM and GMAC both derive their authentication key from the nonce. Feed either one an empty nonce, and that derivation becomes reversible, according to the paper.

Once an attacker holds the recovered key, they can build ciphertexts that pass the algorithm's own authentication check, without ever touching the real key.

It's a short, targeted note, not a break of AES-GCM's underlying math. It hits one specific input: a nonce of zero bits.

Two standards bodies set different minimums for the same primitive, and nothing forces an implementation to pick the stricter one. That's the actual bug. Check whether your AEAD library validates nonce length at the API boundary, instead of trusting that its target spec already forbids zero.

That gap surfaced in the August 7 arXiv security batch, between two standards that set different nonce minimums for the same algorithm.