I read here:
https://www.researchgate.net/publication/220335697_GCM_GHASH_and_Weak_Keys
how GHASH works. So we have $m$ 128-bit blocks $X_{i}$ and we compute in $GF(2^{128})$:
$Y_{m} = \sum_{i=1}^{m} X_{i} \times H^{m-i+1}$
$H$ is a key. Am I see right there that $H$ is raised to the power? Is there method to do it fast in $GF(2^{128})$ or it is just standard exponentiation modulo with fast exponentiation? I thought there is one multiplication in $GF(2^{128})$ on one 128-bit block, but if $H$ is raised to the power, there is much more.
How fast is GHASH itself compared to AES? I mean if AES can achieve $n$ cycles per byte, how fast is GHASH alone? Is perfmormance of GHASH comparable just to one multiplication in $GF(2^{128})$ on every 128 bits of plaintext or is it much complicated?
pclmulqdq
. $\endgroup$