A Note on the Influence of a Zero Length Nonce on GCM and GMAC

Yaobin Shen

A Note on the Influence of a Zero Length Nonce on GCM and GMAC

Cryptography and Security 2026-08-06 v1

Authors: Yaobin Shen

Abstract

In this note, we show a simple attack that can recover the hash key of GCM and GMAC by using a zero length nonce. After recovering the hash key, the adversary can forge an arbitrary ciphertext or message as she wants. We note that the ISO/IEC version of GCM and GMAC allows the nonce to be a zero length string, while the NIST version of GCM and GMAC explicitly requires the nonce to be at least one bit. Hence, our attack works for the ISO/IEC version and cannot work for the NIST version.

Keywords

GCM GMAC hash key recovery zero length nonce forgery attack ISO/IEC standard

Cite

@article{arxiv.2608.06061,
  title  = {A Note on the Influence of a Zero Length Nonce on GCM and GMAC},
  author = {Yaobin Shen},
  journal= {arXiv preprint arXiv:2608.06061},
  year   = {2026}
}