A Note on the Influence of a Zero Length Nonce on GCM and GMAC

Computer Science > Cryptography and Security [Submitted on 6 Aug 2026] A Note on the Influence of a Zero Length Nonce on GCM and GMAC Yaobin Shen In this note, we show a simple attack that can recover the hash key of GCM and GMAC by using a zero length nonce. After recovering the hash key, the adversary can forge an arbitrary ciphertext or message as she wants. We note that the ISO/IEC version of GCM and GMAC allows the nonce to be a zero length string, while the NIST version of GCM and GMAC explicitly requires the nonce to be at least one bit. Hence, our attack works for the ISO/IEC version and cannot work for the NIST version. Subjects: Cryptography and Security (cs.CR) Cite as: arXiv:2608.06061 [cs.CR]   (or arXiv:2608.06061v1 [cs.CR] for this version)   https://doi.org/10.48550/arXiv.2608.06061 Focus to learn more Submission history From: Yaobin Shen [view email] [v1] Thu, 6 Aug 2026 14:07:05 UTC (17 KB) Access Paper: HTML (experimental) view license Current browse context: cs.CR < prev   |   next > new | recent | 2026-08 Change to browse by: cs References & Citations NASA ADS Google Scholar Semantic Scholar Export BibTeX Citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Demos Related Papers About arXivLabs Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)