I am trying to use Intel's optimized AES-128-GCM implementation (from the Intel white paper “Fast Multi-buffer IPsec Implementations on Intel Architecture Processors”, you can find the code here).

The aesni_precomp_* functions take an argument described as the “Hash sub key”. I have researched the role of the “sub key” a bit but I can not fathom what value I should pass in as the “Hash sub key”.

How do I get this nebulous “Hash sub key”?

  • $\begingroup$ They are most likely referring to $H$ which is an all 0 block encrypted with AES using the current key $\endgroup$ Commented Dec 9, 2015 at 21:43
  • $\begingroup$ Yes I believe they are referring to H, but now I have a chicken and egg problem with regard to Intel's API: I need the subkey to encrypt but in order to derive the subkey I need to encrypt... $\endgroup$ Commented Dec 10, 2015 at 13:19
  • $\begingroup$ Could it be that they expect me to pass in the initial block, e.g. all zeroes in this case? After all a comment says: “H, the Hash sub key input.” $\endgroup$ Commented Dec 10, 2015 at 19:52
  • $\begingroup$ $H$ only requires AES to compute, and the functions you are sending it to are all GCM related, so you do not need those functions to compute $H$ $\endgroup$ Commented Dec 10, 2015 at 19:57


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.