I need to implement GCM GHASH in hardware, using FPGA. The data bus is 640 bits, so I will use 5 adder/multiplier blocks in parallel. The message size is fixed and AAD is 0.

A little example: message = 5 x 640 bits.

cycle 1: process 640 bits (add/multiply)
cycle 2: process 640 bits (add/multiply)
cycle 3: process 640 bits (add/multiply)
cycle 4: process 640 bits (add/multiply)
cycle 5: process 640 bits (add/multiply)
cycle 6: process Len 0||C (add/multiply) and xor all results

In the above example, for 5 cycles of data I need 6 cycles to calculate GHASH. The extra cycle is necessary to insert LEN(0||C) in the data flow.

Problem is, I have a continuous data flow and I cannot interrupt it to insert LEN 0||C.

Is it possible to manipulate the GHASH in a way that the processing of LEN(0||C) could be made in advance and just added to the end of processing, saving one processing cycle?

Just to explain better, my architecture is based on this paper: http://ieeexplore.ieee.org/xpl/articleDetails.jsp?tp=&arnumber=5619894&queryText%3DFPGA+parallel-pipelined+AES-GCM+core+for+100G+Ethernet+applications

The add/multiplied data from each adder/multiplicator is saved on a Q memory that have 4 positions. So, at the end of the data, the Q memories positions are xored. The 5 results are then xored and we have the GHASH(CYPHER_TEXT). I have a C model that processes the len_C adding it to the end of the flow, so I know the GHASH(CYPHER_TEXT) result.

In my verilog model, I have almost the same Q memories contents at the end of the data processing, the only difference is caused by the len_c processing. The values are:

  • C model ghash: 0x72a61c9521a6f05da7b16d8fb6b2e115
  • Verilog model GHASH without processing Len_C: 0x3f1cdbad43034cbfc4d09060e08678e7
  • My Len_c (bit mirrored to work with my architecture): 0x00980000000000000000000000000000
  • H: 0x6909696eb6211e31212d7d0a3e07b836

I tried the calculations you proposed but it not works. You guys could please take a look?

  • $\begingroup$ You are talking about GHASH, not GMAC, so is it correct to say that you don't need to perform the final xor with the encrypted IV ? Do you know the GHASH key in advance (e.g. is it fixed) or you have it only during the first cycle ? $\endgroup$
    – Ruggero
    Feb 9, 2015 at 15:25
  • $\begingroup$ You are right, but I'm not finalizing the tag now. I'm using the algorithm from bouncy castle combined ghash, so I need to calculate GHASH(AAD), GHASH(CYPHER_TEXT) and combine it at the end to form the total GHASH, then finalizing it xoring with AESk(J0). For now, I just want to calculate GHASH(CYPHER_TEXT), before combining. Take a look at bouncy castle code (lina 185):link $\endgroup$
    – Rods
    Feb 9, 2015 at 15:31
  • $\begingroup$ To the adder/multiplier blocks in parallel, do you provide $H$, $H^2$, $H^3$, $H^4$, $H^5$ ? $\endgroup$
    – Ruggero
    Feb 9, 2015 at 16:46
  • $\begingroup$ Yes, I pre-calculate all the H powers needed for the ghash. $\endgroup$
    – Rods
    Feb 9, 2015 at 16:48

1 Answer 1


Well, the GCM tag can be rearranged as $Tag = (Len(C, A) \times H) \oplus \textit{Other Stuff}$; if the length of your ciphertext (and additional authentication data) is consistent, you could precompute $Len(C, A) \times H$, and xor that in along with everything else in the final step.

One note: the (add/multiply) that you do in cycle 6 has the side effect of multiplying the result of the GHASH from the ciphertext by $H$; if you eliminate that multiply, you'd need to somehow get the same effect.

  • $\begingroup$ @rods If you provide $H^2$, $H^4$, $H^3$, $H^4$, $H^5$, $H^6$ to your multiplier, instead of $H$, $H^2$, $H^4$, $H^3$, $H^4$, $H^5$ then you should get as result, using poncho's names, $\textit{Other Stuff}$, so that you just need to add (i.e. xor) $(Len(C,A) \times H)$ to get the GHASH result. $\endgroup$
    – Ruggero
    Feb 9, 2015 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.