AES GCM mode - what is ouput in that scheme?

Tom

9/14/23, 5:05 AM

I'm trying to understand that scheme:

https://xilinx.github.io/Vitis_Libraries/security/2019.2/guide_L1/internals/gcm.html

Here on page 11 it looks like GHASH gives only one value "Return $Y_m$":

https://web.cs.ucdavis.edu/~rogaway/ocb/gcm.pdf

After hashing several subsequent blocks. It make no sense to me. If I understand it well every GF128_mult(H) is one block of our output, right? So the stream is consisted of consequtive blocks GF128_mult(H). Am I right or it works in different way? From scheme above it looks like our result (all bits generated for the stream) are just "tag", which seem not to be true.

Or maybe this how it works? We convert all input blocks in one 128-bit tag? And send it as a ciphered message? Then to send every amount of data, we just need 128-bit block? I don't think it works that way, then it is not possible to decrypt it.

0 + 0

aes-gcm

Score:2

Crypto

kodlu

9/14/23, 5:53 AM

The ciphertext block $k$ is obtained by blockwise XOR of the output block $k$ with the plaintext block $k$ [happens in the middle layer of the diagram] for $k=1,2,\ldots,\textrm{len}.$ The ciphertexts are chained together using the GF128_mult mechanism to generate a single authentication tag at the end which is also transmitted.

https://en.wikipedia.org/wiki/Galois/Counter_Mode: Like in normal counter mode, blocks are numbered sequentially, and then this block number is combined with an initialization vector (IV) and encrypted with a block cipher E, usually AES. The result of this encryption is then XORed with the plaintext to produce the ciphertext. Like all counter modes, this is essentially a stream cipher, and so it is essential that a different IV is used for each stream that is encrypted.

The ciphertext blocks are considered coefficients of a polynomial which is then evaluated at a key-dependent point H, using finite field arithmetic. The result is then encrypted, producing an authentication tag that can be used to verify the integrity of the data. The encrypted text then contains the IV, ciphertext, and authentication tag.

0 + 0

Tom

9/14/23, 6:33 AM

So what I saw on this scheme was right. It produces only one block - authentication tag. And if I remember right CTR mode ciphertexts are made in the same way like in GCM, the only difference here is GHASH for authentication tag.