GCM/GHASH is a Carter-Wegman MAC. These all have in common that they tend to be highly efficient, but their problem is that they require a unique key for each m

GCM/GHASH is a Carter-Wegman MAC. These all have in common that they tend to be highly efficient, but their problem is that they require a unique key for each message; when a key is reused, an attacker can forge MACs. This is unlike e.g. HMAC where you don't even have a per-message key/IV. The same caveats thus apply to e.g. Chacha20-Poly1305 (keystream out of counter mode XOR plaintext for encryption, Carter-Wegman MAC).