Some block cipher keys are weak when used with GCM; see this question. This happens when the multiplier $H$ decided by the key ends up in a small-order subgroup of $\mathbb{F}_{2^{128}}$.
Poly1305 has a very similar structure to GHASH. It's the same idea: add in a block, then multiply by a key-...
There are many papers out there that show that a message authenticated and encrypted by AES-GCM can be forged if the used key is weak (e.g. by Handschuh and Preneel, Saarinen or Procter and Cid). With weak keys I refer to the definition given by Handschuh and Preneel:
In symmetric cryptology...
Saarinen in his work GCM, GHASH and Weak Keys says that;
This paper is not very clear and has led many people into regrettable confusion about universal hashing authenticators.
The paper—both the manuscript you cited and the conference paper at FSE 2012—contains misleading claims and misatt...
If you mean that the terminology "weak keys" is inappropriate and that these phenomena do not represent a serious cryptographic deficiency, then I agree. We have been in this state of affairs at least since the "week keys" work on DES.
OTOH is it inappropriate/uninteresting to consider the effect of small multiplicative subgroups on cryptographic constructs, whether these effects are specific to characteristics 2/extension fields, and whether key restrictions have a material affect on these? I think no.
Would an initial disclaimer along the lines that I disagree with the implications of the term "weak keys", but think that the existence of the same property in prime fields/binary fields be an acceptable amendment to you?
It's not that they don't represent a serious cryptographic deficiency. It's that they don't represent any deficiency whatsoever in the very simple security guarantee: the forgery probability for Poly1305 after n attempts is bounded by n*L/2^106, full stop, end of story, no if's and's or but's, no caveats or footnotes; and people keep getting misled by this specious series of papers about irrelevant algebraic structure into the misapprehension that they imply security concerns.
(L = maximum message length in blocks accepted by receiver)
mjos recommends replacing the binary field GF(2^128) by the prime field GF(2^128 + 12451) in AES-GCM, which has no improvement whatsoever on the security guarantee (other than a negligible change to the denominator), and completely changes all the implementation and deployment issues (terrible choice of prime!). It's like suggesting that because you might accidentally stab your eye out with a fork while eating salad, you should tune instruments with a tuning spoon instead of a tuning fork.
The papers should be retracted and the authors should issue an apology to everyone they've misled into thinking they indicate security problems.
Saarinen in his work GCM, GHASH and Weak Keys says that;
This paper is not very clear and has led many people into regrettable confusion about universal hashing authenticators.
The paper—both the manuscript you cited and the conference paper at FSE 2012—contains misleading claims and misatt...
