In the Bouncy Castle libraries, the GCM cipher implementation has an interesting property that does not seem described in the GCM papers (neither the NIST or the original paper):
Some AAD was sent after the cipher started. We determine the difference b/w the hash value we actually used when the cipher started (
S_atPre
) and the final hash value calculated (S_at
). Then we carry this difference forward by multiplying byH^c
, wherec
is the number of (full or partial) cipher-text blocks produced, and adjust the current hash.
This scheme is present in the final calculations (in the doFinal()
method).
Now what I understand is that addition of within the polynomial is equivalent to XOR. I can also see why exponentiation is required to carry the difference forward. What I don't see is how the complete scheme works, especially for partial 16 byte blocks.
Can somebody show how the adjustment in the doFinal
method is defined mathematically?
Note that the $\operatorname{GHASH}$ function is performed over the follwing data within GCM:
$S = \operatorname{GHASH}_H (A || 0^v || C || 0^u || [len(A)]_{64} || [len(C)]_{64})$
where
- $0^v$ and $0^u$ is padding (0..127 bits of zero's) up to the block size
$\operatorname{GHASH}$ itself is defined as follows:
Steps:
- Let $X_1, X_2, ... , X_{m-1}, X_m$ denote the unique sequence of blocks such that $X = X_1 || X_2 || ... || X_{m-1} || X_m$.
- Let $Y_0$ be the “zero block,” $0^{128}$.
- For $i = 1, ..., m$, let $Y_i = (Y_{i-1} \oplus X_i) • H$.
- Return $Y_m$
and
- $X•Y$ is the product of two blocks, $X$ and $Y$, regarded as elements within the binary Galois field
So in this scheme additional AAD ($A$) is send after ciphertext ($C$) was already put within the calculation.