Tag Info

AES-GCM encrypts the plaintext in the Counter Mode. GHASH operates on the resulting ciphertext, so no weakness in GHASH could compromise the confidentiality of plaintext. The GCM authentication is not as strong as that of SHA-256, in particular on short tags. If the tag is $\tau$-bit, an adversary can forge the tag after $2^{\tau/2}$ attempts given the ...