THE GARDEN

AES-GCM Forbidden Attack (Nonce Reuse Tag Forgery)

Updated 19 Sep 2026

• •

  What it is

  • •

    GCM authenticates ciphertext by evaluating GHASH — a polynomial in a secret authentication key $H$ over $GF(2^{128})$ — at the point $H$, using the associated data and ciphertext blocks as coefficients, then masking the result with an AES-encrypted nonce. If the SAME (key, nonce) pair is ever reused to authenticate two different ciphertexts, the encrypted-nonce mask cancels out when the two tag equations are XORed together, leaving a polynomial equation in $H$ that can be solved directly — recovering $H^2$ (or $H$ itself, given field square roots) without ever touching the AES key. Once $H$ is known, an attacker can forge a valid tag for any chosen ciphertext, completely defeating GCM's authentication guarantee. This is the real "GCM forbidden attack," and nonce reuse is precisely the bug class behind the vulnerability this challenge's flag references.

• •

  When to apply

  • •

    A service lets you obtain multiple (ciphertext, tag) pairs authenticated under the same nonce (and same associated-data structure), and you want to forge a valid tag for ciphertext you didn't get to legitimately authenticate.

• •

  Math

  • •

    For one-block ciphertexts with identical nonce, AAD, and lengths, $T_1\oplus T_2=(C_1\oplus C_2)H^2$ in $\mathrm{GF}(2^{128})$. Recover $H^2$ by field division, take the unique field square root $H$, then recover the common mask $S=E_K(J_0)$ from one complete tag equation. $J_0$ equals the nonce only through GCM’s specified IV processing; write $E_K(J_0)$, not $E_K(\text{nonce})$.

• •

  Worked example

  • •

    Encrypting two different 16-byte plaintexts under the same reused nonce gave two (ciphertext, tag) pairs. Computing $h^2 = (t_1 \oplus t_2)/(c_1 \oplus c_2)$ in $GF(2^{128})$, then $E_K(n) = t_1 \oplus \text{GHASH}(c_1)$, let the actual solve forge a valid tag for a third, never-legitimately-authenticated ciphertext (an encryption of the forbidden phrase give me the flag), which the server decrypted, verified, and returned the real flag for.

• •

  SageMath

  • •

    BF.<X> = GF(2)[]
    FF.<A> = GF(2^128, modulus=X^128 + X^7 + X^2 + X + 1)
    
    h_squared = (t1 - t2) / (c1 - c2)   # field division, trivial in Sage
    h = sqrt(h_squared)                 # Sage takes square roots in GF(2^128) directly
    

• •

  Related

• •

  Cards

  • •

    What single server-side mistake makes the GCM forbidden attack possible?

    • •

      Reusing the same (key, nonce) pair to authenticate two different ciphertexts.

  • •

    What does recovering H² let an attacker do, even without the underlying AES key?

    • •

      Forge a valid authentication tag for any ciphertext of their choosing.

◌ Explore connections in Graph view