Overview

This chapter examines a 2026 arXiv note's attack on an ISO/IEC formulation of GCM and GMAC that permits a zero-length nonce. In that formulation, empty-nonce processing makes the starting value zero, so the tag mask equals the GHASH subkey H; an observed or chosen query can then yield an equation that supports H recovery and forgery under the note's conditions. This is an input-domain failure, not ordinary reuse of a nonempty IV. The chapter contrasts it with NIST's stated minimum of one bit and explains why applying the result to a product requires evidence about its formulation, accepted input, and adversary access.

Learning outcomes

The 2026 note targets an ISO/IEC formulation that permits a zero-length nonce; it is not a finding about every GCM implementation.
In the note's formulation, the empty nonce makes the tag mask equal H, enabling algebraic recovery and forgery under the stated query conditions.
NIST's stated one-bit minimum excludes this exact empty-nonce case, but does not replace key-scoped uniqueness or product-specific validation.

Keywords

AES-GCMnonceISO/IECGMACGHASHforgery

When an Empty Nonce Changes the Rules

The zero-length-nonce result is a precise test of AES-GCM's input contract. A 2026 note examines an ISO/IEC formulation of GCM and GMAC that permits an empty nonce, and reports that this accepted value can expose the GHASH key and enable forgery under the note's attack model. The goal here is to understand the target, the algebraic reason, and the limits of the claim—not to turn a result about one formulation into a statement that all GCM implementations are vulnerable.

This distinction matters because nonce failure has more than one cause. An ordinary repeated nonce reuses a value that was meant to be unique for a new input. The case examined here can fail before a collision occurs: the input domain itself permits a value that makes GCM's starting point degenerate. Both cases reach into the relationship between counter encryption and GHASH, but they must be kept separate when evaluating a standard or a product.

A standard boundary changes the attack surface

The note describes GCM and GMAC in a variable-length-nonce formulation. It states that the ISO/IEC version allows a nonce of length zero, while the NIST version requires the nonce to contain at least one bit. That is the first fact to establish. The attack is not directed at an abstract word—“GCM”—without regard to the rules around it. It is directed at a formulation whose permitted input domain includes the empty string.

The minimum-length difference is not cosmetic. A nonce is an input to the algorithm that determines the starting value for counter encryption and tag formation. If a standard excludes an empty input, an implementation that follows that boundary does not enter the exact case described by the note. If another implementation accepts the empty input because its interface follows the more permissive formulation, it has accepted an input that requires separate security analysis.

This is also why a nonce's accepted length should not be confused with its secrecy. The empty string is not dangerous because an observer can see it; it is dangerous in the note because its value interacts with the GCM derivation in a special way. A public, nonempty nonce can still be unsafe if it is reused under one key. Conversely, refusing an empty nonce prevents this particular degenerate input, but does not by itself allocate unique nonempty values across messages.

The note's result therefore has two scopes. Its direct scope is an ISO/IEC version that permits the empty nonce. Its broader design lesson is that an API's input domain belongs to the cryptographic contract. The minimum, maximum, and interpretation of an IV or nonce are not harmless interface details to be left for each caller to guess. They determine which internal states the algorithm can reach.

The distinction from ordinary nonce reuse is equally important.

Published by DeepMox

FAQ

Does the empty-nonce attack apply to every AES-GCM implementation?

No. The result targets an ISO/IEC formulation that permits an empty nonce, and applying it to a product requires evidence that the product accepts that input and exposes the note’s required query or transcript.

Why does a zero-length nonce expose AES-GCM's GHASH key in the note?

It makes the IV-derived starting value the zero block, so the tag mask equals H, the GHASH subkey; the observed tag can then provide an algebraic equation in H under the note’s conditions.

What must be verified before applying the empty-nonce result to a product?

The product’s GCM formulation and accepted input domain must be verified, along with the adversary’s ability to observe or choose the empty-nonce encryption query assumed by the note.

Previous8 minAES-GCM Failure Chain

Next9 minHow to Keep AES-GCM Nonces Unique

AES-GCM Empty Nonce Risk

When an Empty Nonce Changes the Rules

A standard boundary changes the attack surface

FAQ