@kelalaka AES-GCM still authenticates the ciphertext even if the associated data (AD, or sometimes AAD, additional associated data) is empty. The AD is typically a packet header or similar which must be transmitted in the clear anyway.

@SqueamishOssifrage You are absolutely right, my mistake.

I confused tag and AD, hrr.

AES-GCM is actually an instance of A5 in the paper, not of A9.

In particular, if the system always incorporates the AD into the tag computation, then for a particular message authenticated with nonempty AD and then modified in transit to strip the AD, the recipient will reject the empty AD as a forgery (and vice versa, authenticate empty AD and let adversary stick nonempty AD on in transit, and the recipient will reject it as a forgery).

A9 is where the system incorporates the AD into the IV computation, and not (directly) into the tag computation, which is not how AES-GCM works.

Indeed, another halt option.