Why does Carter-Wegman (and AES-GCM) use different keys for PRF and keyed-hash So. As I understand, Carter-Wegman transforms a one-time MAC (which must be a difference unpredictable function (DUF)) by encrypting it with a PRF.

The DUF and the PRF use two different keys, which can be understandable if:


you're just being precautious and not mixing keys
the PRF and the DUF might take keys of different sizes/format


Now, AES-GCM uses AES and GHASH which both take keys of size 128-bit. So why don't they use the same key?
Let's consider a degenerate case. Suppose you're authenticating 16-byte messages, your DUF (better known as (almost) xor-universal hash) is $\text{AES}_k$, and your PRF is also $\text{AES}_k$. Then you have
$$
\text{WC}(m, n) = \text{AES}_k(m) \oplus \text{AES}_k(n)\,,
$$
where $m$ is your 16-byte message, and $n$ is a 16-byte nonce. This is obviously forgeable by simply switching the nonce and the message! Yet, it would be perfectly secure if we used independent keys for each primitive.

In less degenerate cases, such as GCM, you could possibly use the same key for both. But you would have no easy way of arguing the security of the scheme, since the hash and the PRF would not be independent.