How AES-CTR is used in AES-GCM to generate cipherText and a authTag to authenticate the cipherText and authData?

Question

Let,

Inputs:

key = key used to encrypt the plaintext.
IV = initialization vector.
plainText = plaintext need to be encrypted.
authData = addition data need to be authenticated which is not encrypted.

Outputs:

cipherText = encrypted plain text.
authTag = Authentication tag required to verify authenticity of cipherText and authData

Then,

cipherText = aes-ctr(key, IV+1, plainText);
authTag = AES-CTR(key, IV, keyDependentPoint-H(key, (cipherText-aes-ctr + authdata)));

Note: IV+1 is used for generating cipherText and the first IV is saved for encrypting the generated hash at later point of time when cipherText is generated.

Ref: GCM-Galois Counter Mode with IV & Cipher

Ref: Galois/Counter Mode

am I doing any mistake?

This question is asked to ensure the above relation of AES-GCM with AES-CTR is correct and help others to understand AES-GCM in a simple and convincing way.

This question is derived from this question.

Answer 1

AES-GCM,or more generally GCM is a mode of operation for a symmetric block cipher. It stands for Galois/Counter Mode. It provides Authenticated Encryption, guaranteeing both confidentiality (data secrecy) and integrity (data authenticity).

Confidentiality is provided by the Counter Mode: roughly a counter is encrypted and the output is xored with the plaintext. If more than one block has to be encrypted, the counter is incremented.

To be secure, GCM requires that the counter is used only once (See here for details Nonce reuse vulnerability). It is usually generated as the concatenantion of a NONCE and an actual counter (e.g.: $NONCE || 0...0)$.

Please note that the standard GCM construction uses the encryption of the counter from 1 to do the actual encryption, while the encryption of the zero-counter is used in the AuthTag computation

---

From a confidentiality point of view they are the same. Indeed, AES-GCM is defined as AES-CTR + GMAC as authentication code.

The difference is that AES-CTR does not provide integrity protection and an AuthTag has to be added (could be HMAC, or CBC-MAC for example); on the other side the AES-GCM provides both protection (confidentiality and integrity).