16.2 GCM security

GCM’s biggest security risk is its fragility in case of nonce repetition. NIST’s GCM standard [57] requires the following:

The probability that the authenticated encryption function ever will be invoked with the same IV and the same key on two (or more) distinct sets of input data shall be no greater than 2⁻³².

Moreover, care must be taken that the nonces do not repeat: if the same nonce N is used twice in an AES-GCM computation, an attacker would be able to compute the authentication key H. With the help of H, tags for any ciphertext, associated data, or both can be fabricated.

This is easy to see with a little bit of math. The authentication tag is computed as:

Now, if we have two tags T₁ and T₂ computed with the same nonce N, we can XOR T₁ and T₂ to obtain the following expression:

Because x ⊕ x = 0, the term E_K(N∥0) (the AES encryption of N∥0 under the secret key K) will vanish. As a result, the attacker obtains...