NIST SP800-38D section 18.104.22.168 is clear that empty nonces are not allowed with GCM, but without explaining the reasoning. My assumption was this is simply because the probability of error (encrypting multiple messages with an empty nonce) would be to high in any system that supported empty nonces at all. As NIST does not allow it, my GCM implementation does not support empty nonces.
However I was recently directed to Apple's CoreCrypto library which has a special function
ccgcm_set_iv_legacy to enable empty nonces, and the documentation for this function includes the statement
"Zero-length IVs nullify the authenticity guarantees of GCM."
Can anyone explain what is meant by this? Of course if you encrypt multiple messages with GCM using a zero-length IV and the same key you have a serious problem. But is there something more to this warning? In particular can you safely encrypt a message with a zero-length IV as well as some number of messages with non-zero length IVs?