# AES-GCM: What can be done if 'H' is known by an attacker

What could an attacker do, if he had access to the value $H = AES(0)$ used for authentication in AES-GCM?

Could the attacker do anything? Add some data in the authentication chain?

Thanks

If the authentication key $$H$$ is known to an attacker, he could authenticate forged ciphertext and make the receiver believe that it is authentic.
• @abe How can you recover a one-time pad $p$ if you know the message $m$ and the ciphertext $c = m \oplus p$? – Squeamish Ossifrage Apr 23 '19 at 15:29