I'm planning to implement a parallelizable variant of AES to end-to-end-encrypt files in a web application.
As a mode of operation I'm most likely gonna use CTR mode with a 64 bit IV and 64 bit counter, since that allows for easy parallelization.
Now it would also be great to be able to verify that the message wasn't manipulated, so I have to hash it somehow. However, most "normal" hash methods don't work in parallel, which is why I want to use a merkle tree.
From my understanding, it should be possible to encrypt, decrypt and verify the data completely in parallel, is that true?
In addition to that, I've seen that a lot of hashing methods (like GCM) verify the length of the ciphertext. Is that necessary with a merkle tree? I'd assume that the way such a tree builds the hash, it would be really hard to manipulate the length.
Also, should I hash the plaintext or ciphertext? and how should I encrypt the hash value?
Note: I'd like to avoid GCM, since it performs quite poorly on some devices I have to support.