What could an attacker do, if he had access to the value $H = AES(0)$ used for authentication in AES-GCM?

Could the attacker do anything? Add some data in the authentication chain?



If the authentication key $H$ is known to an attacker, he could authenticate forged ciphertext and make the receiver believe that it is authentic.

This is very problematic, since the encryption part of the GCM mode is standard CTR mode encryption, which is actually a stream cipher. And like any other stream cipher, it is susceptible to a bit flip attack, where the attacker can alter any bit in the plaintext without actually knowing it.

  • 3
    $\begingroup$ And, in particular, in the bit flip attack, the attacker can compute precisely which bits of the tag need to be flipped... $\endgroup$
    – poncho
    Nov 9 '17 at 16:19
  • $\begingroup$ Thanks for the answers. But in AES-GCM, the last step of the authentication tag creation is to xor AES(Counter 0) to the previously computed multiplications. If the attacker only knows H, I don't understand how he could re-compute a valid tag after bit-flip, as he does not know AES(Counter 0) $\endgroup$
    – abe
    Nov 10 '17 at 6:05
  • $\begingroup$ @abe How can you recover a one-time pad $p$ if you know the message $m$ and the ciphertext $c = m \oplus p$? $\endgroup$ Apr 23 '19 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.