Low-level GCM ignores the operation nonce

In all published versions of `dcrypt-algorithms` before 2.0.0, the low-level `Gcm` builder required an operation nonce but derived `J0` from the nonce captured by the original `Gcm` constructor. Multiple operations could therefore silently reuse a nonce even when callers supplied distinct values, compromising confidentiality and authenticity under an affected key. Version 2.0.0 makes `Gcm` key-only and passes the operation nonce through IV derivation, encryption, and decryption. It also corrects non-96-bit IV processing, rejects tags shorter than 96 bits, and enforces counter limits. Applications must upgrade, identify affected keys, rotate them, and re-encrypt affected data; updating the implementation cannot restore security after nonce reuse.

Source published

9 Aug 2026 12:00:00 UTC

Source modified

12 Oct 2026 18:00:14 UTC

Observed here

24 Oct 2026 13:19:54 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.