Lion Cipher Lab
Forge an AES-GCM tag by reusing a nonce (the forbidden attack)
- Foundations
- Advanced
- ~90 min
- Free · no account required
Why it matters
AES-GCM is the default authenticated cipher of the modern internet -- TLS, VPNs, disk and message encryption all lean on it. It is fast and safe with one non-negotiable condition: a given key must NEVER encrypt two messages under the same nonce. Break that rule once and an attacker who sees the two ciphertexts can recover the secret authentication subkey and forge tags at will -- total loss of integrity, without ever learning the AES key. Nonce reuse has broken real TLS implementations, and once you have forged a tag by hand you will treat 'never repeat a nonce' as the load-bearing rule it is.
What you'll learn
- How AES-GCM combines AES-CTR encryption with a GHASH authenticator
- GF(2^128) arithmetic and the GCM reduction polynomial
- Recovering the GHASH subkey H from a nonce-reuse tag collision
- Forging a valid AEAD tag without the key (the forbidden attack)
- Choosing between AES-GCM, AES-GCM-SIV, and ChaCha20-Poly1305
Steps in this lab
- What AES-GCM actually is, in one breath
- The one number GCM's security rests on: H = AES_K(0^128)
- The forbidden rule: never reuse a (key, nonce) pair
- Set up a clean workspace
- Lay down the field arithmetic: GF(2^128)
- Play the buggy sender: two messages, one nonce
- The algebra: why two same-nonce pairs leak H
- Forge a tag the library accepts
- The fix: never repeat a nonce -- and prove it
- The judgment call: which AEAD, and the birthday trap