# Save the last cycle in GCM GHASH calculation

I need to implement GCM GHASH in hardware, using FPGA. The data bus is 640 bits, so I will use 5 adder/multiplier blocks in parallel. The message size is fixed and AAD is 0.

A little example: message = 5 x 640 bits.

cycle 1: process 640 bits (add/multiply)
cycle 2: process 640 bits (add/multiply)
cycle 3: process 640 bits (add/multiply)
cycle 4: process 640 bits (add/multiply)
cycle 5: process 640 bits (add/multiply)
cycle 6: process Len 0||C (add/multiply) and xor all results


In the above example, for 5 cycles of data I need 6 cycles to calculate GHASH. The extra cycle is necessary to insert LEN(0||C) in the data flow.

Problem is, I have a continuous data flow and I cannot interrupt it to insert LEN 0||C.

Is it possible to manipulate the GHASH in a way that the processing of LEN(0||C) could be made in advance and just added to the end of processing, saving one processing cycle?

Just to explain better, my architecture is based on this paper: http://ieeexplore.ieee.org/xpl/articleDetails.jsp?tp=&arnumber=5619894&queryText%3DFPGA+parallel-pipelined+AES-GCM+core+for+100G+Ethernet+applications

The add/multiplied data from each adder/multiplicator is saved on a Q memory that have 4 positions. So, at the end of the data, the Q memories positions are xored. The 5 results are then xored and we have the GHASH(CYPHER_TEXT). I have a C model that processes the len_C adding it to the end of the flow, so I know the GHASH(CYPHER_TEXT) result.

In my verilog model, I have almost the same Q memories contents at the end of the data processing, the only difference is caused by the len_c processing. The values are:

• C model ghash: 0x72a61c9521a6f05da7b16d8fb6b2e115
• Verilog model GHASH without processing Len_C: 0x3f1cdbad43034cbfc4d09060e08678e7
• My Len_c (bit mirrored to work with my architecture): 0x00980000000000000000000000000000
• H: 0x6909696eb6211e31212d7d0a3e07b836

I tried the calculations you proposed but it not works. You guys could please take a look?

• You are talking about GHASH, not GMAC, so is it correct to say that you don't need to perform the final xor with the encrypted IV ? Do you know the GHASH key in advance (e.g. is it fixed) or you have it only during the first cycle ? – Ruggero Feb 9 '15 at 15:25
• You are right, but I'm not finalizing the tag now. I'm using the algorithm from bouncy castle combined ghash, so I need to calculate GHASH(AAD), GHASH(CYPHER_TEXT) and combine it at the end to form the total GHASH, then finalizing it xoring with AESk(J0). For now, I just want to calculate GHASH(CYPHER_TEXT), before combining. Take a look at bouncy castle code (lina 185):link – Rods Feb 9 '15 at 15:31
• To the adder/multiplier blocks in parallel, do you provide $H$, $H^2$, $H^3$, $H^4$, $H^5$ ? – Ruggero Feb 9 '15 at 16:46
• Yes, I pre-calculate all the H powers needed for the ghash. – Rods Feb 9 '15 at 16:48

Well, the GCM tag can be rearranged as $Tag = (Len(C, A) \times H) \oplus \textit{Other Stuff}$; if the length of your ciphertext (and additional authentication data) is consistent, you could precompute $Len(C, A) \times H$, and xor that in along with everything else in the final step.
One note: the (add/multiply) that you do in cycle 6 has the side effect of multiplying the result of the GHASH from the ciphertext by $H$; if you eliminate that multiply, you'd need to somehow get the same effect.
• @rods If you provide $H^2$, $H^4$, $H^3$, $H^4$, $H^5$, $H^6$ to your multiplier, instead of $H$, $H^2$, $H^4$, $H^3$, $H^4$, $H^5$ then you should get as result, using poncho's names, $\textit{Other Stuff}$, so that you just need to add (i.e. xor) $(Len(C,A) \times H)$ to get the GHASH result. – Ruggero Feb 9 '15 at 16:58