1
$\begingroup$

So I found some test vectors for my SSE implementation of AES256-GCM and unfortunately it seems that after the last step of AAD it goes wrong. My guess is that this is because the AAD is actually misaligned; it's 8-byte instead of 16. I read this into a 128-bit vector and read the byte array into it as a byte array and initialize it to zero first. Is the document with test vectors just wrong, or am I padding incorrectly? With SHA256 you pad with 0x80 and then 0x00s, does AES256-GCM require the same?

Thanks for the help.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$

With SHA256 you pad with 0x80 and then 0x00s, does AES256-GCM require the same?

For GCM, the AAD is zero-padded to a multiple of 16 bytes (with no padding if it's already a multiple of 16 bytes in length). We include the bit length of the AAD (and the length of the plaintext) within the final 16 byte block (that comes immediately after the plaintext), hence there is no need to specify that length within the padding.

See figure 3 of the GCM Specification for a general overview.

Improve this answer
$\endgroup$
4
  • $\begingroup$ Thank you, just what I thought. I saw that in most of the diagrams so was unsure why I saw 1 or 2 that didn't do it like that. Guess I'll just go with the gcm-spec.pdf and wycheproof test vectors then. $\endgroup$
    – Niels
    Jan 6 at 21:33
  • $\begingroup$ Make sure that the padding is on the correct side, which in this case probably means that you should fill your buffer from the correct side. Also make sure that that buffer is properly zero'd before you write to it. I hope that you don't pad literally as it is in the theoretic text books by adding bytes to the input message because growing arrays is generally not great when it comes to performance or memory management. $\endgroup$
    – Maarten Bodewes - on strike ♦
    Jan 7 at 14:50
  • $\begingroup$ @MaartenBodewes yes, I'm basically fetching blocks and if I reach the last unaligned block (if any) I'll just load a _m128 of 0 and load my last bytes into the address of the vector. It all seems to work now, I input a lot of test vectors and everything is correct :). Will just have to provide an optimized ghash and a fallback for when these instructions are disabled and decryption and then I'm done. $\endgroup$
    – Niels
    Jan 8 at 11:04
  • $\begingroup$ @poncho To make this more generic, I think the answer should reflect that this is required for GMAC specifically and that the AAD / plaintext / nonce itself isn't altered. Maybe the correct alignment in the buffer and the endianness of the calculation could also be indicated. $\endgroup$
    – Maarten Bodewes - on strike ♦
    Jan 8 at 14:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.