How does GHASH used in GCM behave as a universal hashing function?
Indeed $H=E_k(0)$ is used to choose from the family. This is not a problem, and here is some intuition on why.
The output of the hash function is not leaked in clear, it is &quot;hidden&quot; by xoring with $E_k(iv,ctr=0)$ which is different per each encrypted message (in contrast to $H=E_k(0)$). Otherwise it would be indeed trivial to recover H as the UHF is linear.
Intuitively, the property used is that UHF should be hard to blindly predict the difference for any two inputs without knowing the key, even with multiple attempts, but without revealing the UHF value on each attempt.
Note that the &quot;difference&quot; matters here because in forgery attempts you are allowed to reuse the nonce, so guessing the right difference would suffice for a break. For example, given $$(iv,m,t),~~ t=E_k(iv,ctr=0)\oplus GHASH(m))$$ and guessing the difference $\Delta = GHASH(m)\oplus GHASH(m')$ would allow to forge
$$
(iv,m',t'),~~ t'=t\oplus \Delta=E_k(iv,ctr=0)\oplus GHASH(m').
$$