0
$\begingroup$

I want to write GCM implementation myself (only for research purposes). So far, I have successfully written CTR implementation (for AES), but now I ran into few problems with GCM. If I'm not wrong, the point of GCM is to have authentication data which prevent attacker to change ciphertext, because the authentication tag will not be the same then, and the server won't decrypt data? The GCM is a combination of both authentication tag and ciphertext (separated)? To get the authentication tag, I have to follow this scheme? enter image description here

So, I have to encrypt plaintext data to get ciphertext data and append authentication tag lets say at the end of the ciphertext data?

I would like to know now, what is the Auth Data and H (inside multiplication) and how to get these two varibles? I know that the Auth Data and H are multiplied in GF(128).

| improve this question | |
$\endgroup$
1
$\begingroup$

So, I have to encrypt plaintext data to get ciphertext data and append authentication tag lets say at the end of the ciphertext data?

That is correct, the auth tag is generally appended to the ciphertext. The Nonce component of the counter is also required.

I would like to know now, what is the Auth Data and H

"Auth Data" is additional data that you want authenticated but not encrypted, which could be nothing, or your email address, or anything else.

"H" is the Hash Key, which is an all 0 block encrypted by the block cipher. $Mult_H$ is the act of multiplying the input by H.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Thank you for explanation! So, the "H" (Hash Key) is always 4x4 bytes long? (As the block 0 is 4x4 B (before and after encryption)) $\endgroup$ – osemec Feb 27 '15 at 10:23
  • $\begingroup$ Yes, H is 128-bits $\endgroup$ – Richie Frame Feb 27 '15 at 10:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.