AES-GCM is used with a 96-bit nonce derived from a counter that resets when the process restarts. Two messages are eventually encrypted under the same key and nonce. State precisely what an attacker recovers, and separate the confidentiality loss from the authentication loss.

AES-GCM is used with a 96-bit nonce derived from a counter that resets when the process restarts. Two messages are eventually encrypted under the same key and nonce. State precisely what an attacker recovers, and separate the confidentiality loss from the authentication loss.

Approach: Write GCM as a counter mode keystream plus a polynomial authenticator, then ask what happens when the same keystream and the same authenticator input appear twice.

The attacker recovers the xor of the two plaintexts and, worse, recovers the GHASH authentication key, which lets them forge tags for arbitrary messages under that key from then on. GCM encrypts by generating a counter mode keystream from the key and nonce and xoring it with the plaintext. Reusing a nonce reproduces the identical keystream, so C1 xor C2 equals P1 xor P2 and the keystream cancels. Any known or guessable structure in one message, such as a fixed header or a known field, immediately yields the corresponding bytes of the other, and two English or structured messages xored together are separable by hand. That is the confidentiality loss, the same failure any stream cipher has under key reuse. The authentication loss is specific to GCM and is worse. The tag is a polynomial in a secret value H evaluated over the ciphertext blocks and masked with a keystream block that depends on the nonce. Two tags under the same nonce give an equation whose only unknown is H, and solving it over the field recovers H. With H known the attacker computes valid tags for messages of their own choosing, so the channel is no longer authenticated. A GCM nonce must therefore be unique per key without exception, so derive it from a persistent counter, or use a nonce misuse resistant mode.

Follow-up: You cannot guarantee counter persistence across restarts. What key and nonce discipline makes reuse impossible rather than unlikely?

Key concepts: nonce reuse, keystream, authentication key, forgery.