Salamander

Key commitment in AEAD · invisible salamanders

Forge one real AES-GCM ciphertext and tag that WebCrypto accepts under two different keys, decrypting to two different messages — then watch the security verdict fire even though every tag check passes.