2
$\begingroup$

I'm new to GCM and I need to implement it in hardware, using FPGA. The data bus is 640 bits, so I will use 5 adder/multiplier blocks in parallel. The message size and AAD size are constant. My design have a particularity that AAD and Len A||C are available only at the end of message and I don't kow how to process it.

A little example: message = 5 x 640 bits.

cycle 1: process 640 bits (add/multiply)
cycle 2: process 640 bits (add/multiply)
cycle 3: process 640 bits (add/multiply)
cycle 4: process 640 bits (add/multiply)
cycle 5: process 640 bits (add/multiply) and xor all results
cycle 6: process AAD
cycle 7: process Len A||C

After cycle 5 I have a 128 bits vector with all the messages added/multiplied and results xored. So, how can I process AAD and Len A||C in this scenario?

Thanks Rodolfo

|improve this question|||||
$\endgroup$
1
$\begingroup$

BouncyCastle (for Java) has code that performs the AAD processing anywhere in the stream. It does however require modular exponentiation and additional multiplication. GCM mode officially requires the AAD to be processed before the plaintext, but as stated, there is a way around that. I've asked for an explanation here

Len A||C is only required at the end of the processing anyway, so that should not pose a problem.

|improve this answer|||||
$\endgroup$
  • $\begingroup$ Thanks Maarten. So, If I understand well, I need to multiply the hashed data (end of cycle 5) by H, multiply Len A||C by H and multiply AAD by H^2 and xor the results. Is it correct? Thanks $\endgroup$ – Rods Jan 3 '15 at 12:22
  • $\begingroup$ I'm not sure the above is correct. $+$ is addition and $H^2$ should be $H^c$ I think (modulo calculations, of course). $\endgroup$ – Maarten Bodewes♦ Jan 3 '15 at 14:26
  • $\begingroup$ @MaartenBodewes-owlstead: in $GF(2^{128})$, $+$ is the same as xor, so Rods has that part correct. $\endgroup$ – poncho Jan 3 '15 at 14:55
  • $\begingroup$ @poncho Thanks, that saved me looking at the implementation, I was already grabbing the code. I really should be more mathematically minded, but it is tricky to do this after so many years of just applied crypto & development. $\endgroup$ – Maarten Bodewes♦ Jan 3 '15 at 14:58
  • $\begingroup$ I didn't get the H^c. Is C the related to the message data? Like, C is the number of 128 bits data blocks? Sorry for the basic questions guys. Just to clarify, my implementation is based on this architecture, but with AAD and Len A||C processed separately from data: ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=5619894 $\endgroup$ – Rods Jan 3 '15 at 15:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.