I'm trying to understand that scheme:
Here on page 11 it looks like GHASH gives only one value "Return $Y_m$":
After hashing several subsequent blocks. It make no sense to me. If I understand it well every GF128_mult(H) is one block of our output, right? So the stream is consisted of consequtive blocks GF128_mult(H). Am I right or it works in different way? From scheme above it looks like our result (all bits generated for the stream) are just "tag", which seem not to be true.
Or maybe this how it works? We convert all input blocks in one 128-bit tag? And send it as a ciphered message? Then to send every amount of data, we just need 128-bit block? I don't think it works that way, then it is not possible to decrypt it.