Is GCM with zero-length AAD less secure?

Question

In a previous question, it was made clear that in the case of GCM, there is no distinction between "no AAD" and "zero-length AAD". Since I have noticed "zero-length AAD" in several implementations, my question is, does that render such AE schemes less secure?

In the various papers that treat AE security, I think the paper Reconsidering Generic Composition by Namprempre, Rogaway and Shrimpton might have been the most explicit in this regard. According to their nAE scheme enumeration, the first scheme that shows weaker security bounds is A9 where A (i.e. AAD) is dropped from the Tag computation (see Fig. 5). Now of course, they do mention that it's a borderline case (transitional). But they make it clear that its security is not as tight as the A1-A8 schemes (all of which include A in the tag calculation). I have tried to survey other papers on the topic, but I haven't found a paper that gives a similar treatment.

So if AAD is missing from GCM (or if |AAD|=0), is GCM security downgraded in any way or is our security proof a bit weaker? Or, is that not a conclusion we should take from Namprempre's paper above (assuming their results were accepted by the crypto community)?

Answer 1

AES-GCM falls category A5 in the paper. In AES-GCM doesn't support $\texttt{no-AAD}$, even you don't use AAD during encryption, AES-GCM convert his as a $\texttt{zero-length-AAD}$.

See in the NIST Special Publication 800-38d, page 15;

Algorithm 4: $GCM-AE_K (IV, P, A)$
…
4. Let $u = 128\cdot\lceil\operatorname{len}(C)/128\rceil - \operatorname{len}(C)$ and let $v = 128\cdot\lceil\operatorname{len}(A)/128\rceil - \operatorname{len}(A)$.
5. Define a block, $S$, as follows: $$S = \operatorname{GHASH}_H(\mathbf{A \mathbin\| \mathtt 0^v} \mathbin\| C \mathbin\| \mathtt 0^u \mathbin\| \mathbf{[\operatorname{len}(A)]_{64}} \mathbin\| [\operatorname{len}(C)]_{64}).$$ …
In Steps 4 and 5, the AAD and the ciphertext are each appended with the minimum number of ‘$\mathtt 0$’ bits, possibly none, so that the bit lengths of the resulting strings are multiples of the block size (The bolds, are mine).

$A$ is associated data, $len(A) = 0$ therefore, $\mathtt{v} = 0$. Even in this case, we have $[\operatorname{len}(A)]_{64}$, this 64-bit encoding of the length of th associated data and this will always indicate the exsitance of AAD, zero-length or not!.

If an attacker, removes the associated data, to make it seem like zero-length, during the decryption, one must halt with the tag mismatch ( Always halt and stop the decryption at once).

A scheme that supports no-AAD, must not carry information about the missing AAD, otherwise, it falls into zero-length AAD.

In the end, we have extra protection against forgeries with zero-length AAD.