So I found some test vectors for my SSE implementation of AES256-GCM and unfortunately it seems that after the last step of AAD it goes wrong. My guess is that this is because the AAD is actually misaligned; it's 8-byte instead of 16. I read this into a 128-bit vector and read the byte array into it as a byte array and initialize it to zero first. Is the document with test vectors just wrong, or am I padding incorrectly? With SHA256 you pad with 0x80 and then 0x00s, does AES256-GCM require the same?
With SHA256 you pad with 0x80 and then 0x00s, does AES256-GCM require the same?
For GCM, the AAD is zero-padded to a multiple of 16 bytes (with no padding if it's already a multiple of 16 bytes in length). We include the bit length of the AAD (and the length of the plaintext) within the final 16 byte block (that comes immediately after the plaintext), hence there is no need to specify that length within the padding.