Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-07 · high
The flaw hits only ISO/IEC-conformant AEAD implementations, since NIST's spec blocks empty nonces outright.
Why now: The paper posted August 6, one day before this write-up on August 7.
A zero-length nonce recovers the GCM hash key, per arXiv 2608.06061, posted August 6. With the key exposed, an attacker can forge ciphertexts and messages the system is supposed to authenticate.
The exposure traces to which spec a library validated against. NIST's version of GCM requires a nonce of at least one bit. The ISO/IEC version permits a zero-length nonce string, and that's the version this attack breaks.
Implementations built strictly to ISO/IEC are open to key recovery and forged messages. Implementations built to NIST's version aren't, per the paper.
I'd check whether my AEAD library enforces a minimum nonce length, rather than trusting whichever spec it was built against.
A crypto library is only as safe as the spec it validated against. This bug shows some AEAD implementations have been trusting the wrong one. Watch whether library maintainers start rejecting zero-length nonces outright, regardless of which spec they cite.
Each link below shares sources, entities, or timing with this story.
Same source
Cite the same source (arXiv 2608.06061).
Same source domain / Semantically similar
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.72).
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.68).
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.67).
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.67).
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.67).
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.66).
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.66).