GCM implementation

Question

I want to write GCM implementation myself (only for research purposes). So far, I have successfully written CTR implementation (for AES), but now I ran into few problems with GCM. If I'm not wrong, the point of GCM is to have authentication data which prevent attacker to change ciphertext, because the authentication tag will not be the same then, and the server won't decrypt data? The GCM is a combination of both authentication tag and ciphertext (separated)? To get the authentication tag, I have to follow this scheme?

So, I have to encrypt plaintext data to get ciphertext data and append authentication tag lets say at the end of the ciphertext data?

I would like to know now, what is the Auth Data and H (inside multiplication) and how to get these two varibles? I know that the Auth Data and H are multiplied in GF(128).

Answer 1

So, I have to encrypt plaintext data to get ciphertext data and append authentication tag lets say at the end of the ciphertext data?

That is correct, the auth tag is generally appended to the ciphertext. The Nonce component of the counter is also required.

I would like to know now, what is the Auth Data and H

"Auth Data" is additional data that you want authenticated but not encrypted, which could be nothing, or your email address, or anything else.

"H" is the Hash Key, which is an all 0 block encrypted by the block cipher. $Mult_H$ is the act of multiplying the input by H.