What could an attacker do, if he had access to the value $H = AES(0)$ used for authentication in AES-GCM?
Could the attacker do anything? Add some data in the authentication chain?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
If the authentication key $H$ is known to an attacker, he could authenticate forged ciphertext and make the receiver believe that it is authentic.
This is very problematic, since the encryption part of the GCM mode is standard CTR mode encryption, which is actually a stream cipher. And like any other stream cipher, it is susceptible to a bit flip attack, where the attacker can alter any bit in the plaintext without actually knowing it.