Is the AES-GCM encryption using the SHA256 hash of the plaintext as IV secure?

Question

I want to encrypt a list of unique values and I want the property of when I encrypt the same value I get the same ciphertext (determinism). The adversary only observes the ciphertexts of a unique set of plaintext values. In this context would the following encryption algorithm be secure:

1. I generate the sha256 hash of the plaintext value
2. I use the hash as the IV to AES-GCM to encrypt the plaintext value

Is the resulting ciphertext which includes the hash of the plaintext value secure?

Answer 1

No, because in order to decrypt it you must pass along the SHA-256 hash too, and now you have leaked a public function of the original message, which an adversary can use to efficiently test a guess offline about what the original message was.

If you want a deterministic authenticated cipher, you might consider an existing construction like SIV that has been studied already.