# Post processing of AAD and len A||C in a hardware AES GCM implementation

I'm new to GCM and I need to implement it in hardware, using FPGA. The data bus is 640 bits, so I will use 5 adder/multiplier blocks in parallel. The message size and AAD size are constant. My design have a particularity that AAD and Len A||C are available only at the end of message and I don't kow how to process it.

A little example: message = 5 x 640 bits.

cycle 1: process 640 bits (add/multiply)
cycle 2: process 640 bits (add/multiply)
cycle 3: process 640 bits (add/multiply)
cycle 4: process 640 bits (add/multiply)
cycle 5: process 640 bits (add/multiply) and xor all results
cycle 7: process Len A||C


After cycle 5 I have a 128 bits vector with all the messages added/multiplied and results xored. So, how can I process AAD and Len A||C in this scenario?

Thanks Rodolfo

• I'm not sure the above is correct. $+$ is addition and $H^2$ should be $H^c$ I think (modulo calculations, of course). – Maarten - reinstate Monica Jan 3 '15 at 14:26
• @MaartenBodewes-owlstead: in $GF(2^{128})$, $+$ is the same as xor, so Rods has that part correct. – poncho Jan 3 '15 at 14:55