Low-level GCM ignores the operation nonce

Overview

In all published versions of dcrypt-algorithms before 2.0.0, the low-level Gcm builder required an operation nonce but derived J0 from the nonce captured by the original Gcm constructor. Multiple operations could therefore silently reuse a nonce even when callers supplied distinct values, compromising confidentiality and authenticity under an affected key.

Version 2.0.0 makes Gcm key-only and passes the operation nonce through IV derivation, encryption, and decryption. It also corrects non-96-bit IV processing, rejects tags shorter than 96 bits, and enforces counter limits. Applications must upgrade, identify affected keys, rotate them, and re-encrypt affected data; updating the implementation cannot restore security after nonce reuse.

Affected packages

• dcrypt-algorithms >= 0.0.0-0, < 2.0.0

Remediation

Upgrade to a patched release:

• dcrypt-algorithms 2.0.0