# How does GCM/GMAC work?

My question is simple: where is a good article to learn how GCM/GMAC works? I mean not the description of the algorihm, but why this pair of algorithms for encryption/decryption is really inverse. For me it is not obvous, why encryption of (A+P) --> (C+T) followed by decyption gives again P and the same Tag T...

• Are you sure you are asking about GCM and not for example AES? – axapaxa Nov 5 '16 at 14:57
• I want to understand GCM, given that AES works as expected. OK. You are rigt: The AES part is clear for me. But the question is abot generation of tag. Why is the tag T' = T when I employ authenticated decryption. – MichaelW Nov 5 '16 at 15:10
• I think I see now. It is just a matter of exclusive oring and has nothing to do with calculation in $GF(2^m)$. Right? – MichaelW Nov 5 '16 at 15:24

Actually, the reason both sides get the same T is quite simple; GCM defines the tag as a function of the key, the nonce, the AAD (additional associated data) and the ciphertext. This function happens to be something along the lines of "form a polynomial in $GF(2^{128})$ from the AAD and the ciphertext, evaluate that polynomial on a value $H$ which is a function of the key, and then add in an encryption of the nonce", however the details really aren't important for this question; what's important is that it is a determanistic function of those four things and nothing else.