The Failure Chain, Reassembled

The central judgment about AES-GCM becomes clearer when its already-established parts are treated as one chain rather than as separate facts. A key and IV establish internal starting conditions; GCTR uses those conditions to conceal plaintext; GHASH and the tag bind ciphertext and AAD to the same invocation. This synthesis connects those relationships so a reader can analyze a short scenario, identify which security property is threatened, and avoid claiming more than the evidence supports.

The decisive unit is not an isolated nonce field. It is a key-and-IV domain: every AES-GCM invocation that shares a key must be considered when asking whether an IV is unique. NIST states that the probability of using the same IV with the same key on distinct input sets must be no greater than 2^-32. That wording changes the first question in an incident. Instead of asking whether one process generated a plausible value, ask whether any other device, service, session, restart, or key-management path could have generated the same value under the same key.

A safe invocation is a connected chain

In a normal AES-GCM invocation, the key produces the GHASH subkey H, and the IV produces the pre-counter block J0. Starting from J0, GCM creates counter blocks and applies AES to form the stream that is XORed with plaintext. Separately, GHASH processes AAD, ciphertext, and their lengths using H; a J0-associated mask turns that authentication value into the tag. Authenticated decryption recomputes the relevant values and accepts plaintext only when the tag matches.

This chain gives a useful test for the word “safe.” Safety does not mean that no value is visible or that every nonce is unpredictable. It means that the internal conditions for a distinct input set are not reused within the same key domain, and that the receiver can verify the data that the protocol says it should trust. The IV can travel beside the ciphertext. The condition that cannot be casually shared is the IV's key-scoped uniqueness.

The two branches also explain why a single record can look normal while the collection of records is unsafe. AES can return the right output for every counter block. GHASH can return a mathematically correct value. The receiver can compare two tags without noticing that the same starting point was used before. The violation appears only when invocations are compared across their shared key domain.

A small thought experiment makes the comparison concrete. Take two records, each with a body, visible authenticated context, an IV, and a tag. If their keys differ, seeing the same IV text does not establish the repeated key-specific counter condition described here. If their keys match and their IVs match while the records differ, both the encryption and authentication branches must be investigated. The same observation has a different meaning depending on which values were shared and which inputs changed.

The order of reasoning matters. First establish the key domain and whether the inputs are distinct. Next identify the internal value that repeats: the counter path follows J0, while the tag path follows H and the J0-based mask. Only then ask what was observable and whether an adversary could turn a relationship into a successful forgery.