# AES-GCM: What can be done if 'H' is known by an attacker

What could an attacker do, if he had access to the value $H = AES(0)$ used for authentication in AES-GCM?

Could the attacker do anything? Add some data in the authentication chain?

Thanks

If the authentication key $$H$$ is known to an attacker, he could authenticate forged ciphertext and make the receiver believe that it is authentic.

This is very problematic, since the encryption part of the GCM mode is standard CTR mode encryption, which is actually a stream cipher. And like any other stream cipher, it is susceptible to a bit flip attack, where the attacker can alter any bit in the plaintext without actually knowing it.

• And, in particular, in the bit flip attack, the attacker can compute precisely which bits of the tag need to be flipped... – poncho Nov 9 '17 at 16:19
• Thanks for the answers. But in AES-GCM, the last step of the authentication tag creation is to xor AES(Counter 0) to the previously computed multiplications. If the attacker only knows H, I don't understand how he could re-compute a valid tag after bit-flip, as he does not know AES(Counter 0) – abe Nov 10 '17 at 6:05
• @abe How can you recover a one-time pad $p$ if you know the message $m$ and the ciphertext $c = m \oplus p$? – Squeamish Ossifrage Apr 23 '19 at 15:29