I want to write GCM implementation myself (only for research purposes). So far, I have successfully written CTR implementation (for AES), but now I ran into few problems with GCM. If I'm not wrong, the point of GCM is to have authentication data which prevent attacker to change ciphertext, because the authentication tag will not be the same then, and the server won't decrypt data?
The GCM is a combination of both authentication tag and ciphertext (separated)? To get the authentication tag, I have to follow this scheme?
So, I have to encrypt plaintext data to get ciphertext data and append authentication tag lets say at the end of the ciphertext data?
I would like to know now, what is the Auth Data and H (inside multiplication) and how to get these two varibles? I know that the Auth Data and H are multiplied in GF(128).