AES-GCM nonce reuse (forbidden attack)
Recover the GHASH authentication key from two messages encrypted under the same key and nonce, then forge arbitrary authenticated ciphertexts.
Open in ctfpalGCM’s confidentiality degrades to a reused keystream when a nonce repeats - the same problem as any stream cipher, addressable by crib dragging. Its authentication fails far more catastrophically: the reuse leaks the GHASH subkey H, and with H an attacker can forge a valid tag for any message they like.
Solving for H
GHASH is a polynomial evaluation in GF(2^128) with H as the variable. Two messages under the same nonce give two tag equations; subtracting them cancels the nonce-derived masking term and leaves a polynomial in H alone. Find its roots in GF(2^128) and one of them is the real subkey - test each against a known tag to identify which.
Related tools
AES decryption tool (CBC, GCM, CTR, ECB)
Decrypt AES in every common mode and key size, with hex, Base64, or UTF-8 key material and automatic PKCS#7 padding removal. Runs on Web Crypto in your browser.
CBC padding oracle attack
Decrypt CBC ciphertext one byte at a time using only a valid/invalid padding signal - Vaudenay’s attack, explained and driven.
XOR crib dragging for many-time pads
Recover both plaintexts when a one-time pad key is reused, by dragging a guessed word along the XOR of two ciphertexts.
RSA decryption and attack runner
Paste n, e, and c and let ctfpal choose the attack: trial division, Fermat, Pollard’s rho, Wiener, common modulus, or Hastad broadcast. Arbitrary-precision, in-browser.