In a previous question, it was made clear that in the case of GCM, there is no distinction between "no AAD" and "zero-length AAD". Since I have noticed "zero-length AAD" in several implementations, my question is, does that render such AE schemes less secure?
In the various papers that treat AE security, I think the paper Reconsidering Generic Composition by Namprempre, Rogaway and Shrimpton might have been the most explicit in this regard. According to their nAE scheme enumeration, the first scheme that shows weaker security bounds is A9 where A (i.e. AAD) is dropped from the Tag computation (see Fig. 5). Now of course, they do mention that it's a borderline case (transitional). But they make it clear that its security is not as tight as the A1-A8 schemes (all of which include A in the tag calculation). I have tried to survey other papers on the topic, but I haven't found a paper that gives a similar treatment.
So if AAD is missing from GCM (or if |AAD|=0), is GCM security downgraded in any way or is our security proof a bit weaker? Or, is that not a conclusion we should take from Namprempre's paper above (assuming their results were accepted by the crypto community)?