My question is simple: where is a good article to learn how GCM/GMAC works? I mean not the description of the algorihm, but why this pair of algorithms for encryption/decryption is really inverse. For me it is not obvous, why encryption of (A+P) --> (C+T) followed by decyption gives again P and the same Tag T...
$\begingroup$
$\endgroup$
3
-
$\begingroup$ Are you sure you are asking about GCM and not for example AES? $\endgroup$– axapaxaNov 5, 2016 at 14:57
-
$\begingroup$ I want to understand GCM, given that AES works as expected. OK. You are rigt: The AES part is clear for me. But the question is abot generation of tag. Why is the tag T' = T when I employ authenticated decryption. $\endgroup$– MichaelWNov 5, 2016 at 15:10
-
$\begingroup$ I think I see now. It is just a matter of exclusive oring and has nothing to do with calculation in $GF(2^m)$. Right? $\endgroup$– MichaelWNov 5, 2016 at 15:24
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
For me it is not obvous, why encryption of (A+P) --> (C+T) followed by decyption gives again P and the same Tag T...
Actually, the reason both sides get the same T is quite simple; GCM defines the tag as a function of the key, the nonce, the AAD (additional associated data) and the ciphertext. This function happens to be something along the lines of "form a polynomial in $GF(2^{128})$ from the AAD and the ciphertext, evaluate that polynomial on a value $H$ which is a function of the key, and then add in an encryption of the nonce", however the details really aren't important for this question; what's important is that it is a determanistic function of those four things and nothing else.
When the encryptor produces the ciphertext, he computes this function (using his copy of the key, nonce and AAD), generating the tag.
When the decryptor receives the ciphertext, he also computes the function. If the ciphertext was the same (that is, not modified in transit), and the nonce, AAD and the keys are also the same, then he'll compute the same tag (as he does the same function with the same inputs).
