Authentication Failures in NIST version of GCM

In this note, we study the security of the Galois/Counter mode authenticated encryption recently published by NIST. We show how an adversary can recover the secret key of the keyed hash function underlying the authentication, using a chosen IV attack. Once this secret key is known, the encryption mode is no longer authenticated. As a con­ sequence, all chosen ciphertext attacks against the confidentiality become feasible. Moreover, since the encryption mode is a counter mode, i.e. a stream cipher, the XOR malleability of the encrypted plaintext becomes a major security issue.