Skip to content
All tools
Modern cryptoRuns locallyNo account

AES-GCM nonce reuse (forbidden attack)

Recover the GHASH authentication key from two messages encrypted under the same key and nonce, then forge arbitrary authenticated ciphertexts.

Open in ctfpal

GCM’s confidentiality degrades to a reused keystream when a nonce repeats - the same problem as any stream cipher, addressable by crib dragging. Its authentication fails far more catastrophically: the reuse leaks the GHASH subkey H, and with H an attacker can forge a valid tag for any message they like.

Solving for H

GHASH is a polynomial evaluation in GF(2^128) with H as the variable. Two messages under the same nonce give two tag equations; subtracting them cancels the nonce-derived masking term and leaves a polynomial in H alone. Find its roots in GF(2^128) and one of them is the real subkey - test each against a known tag to identify which.

Related tools