5
$\begingroup$

To calculate the authentication tag in the Galois/Counter mode (GCM), first a MAC is calculated using GHASH over the cipher text and the additional data. After that, this MAC is encrypted using GCTR (using the first counter).

My question is: Why is this last encryption step neccesary? What would the security problem be, if I just used the output of GHASH directly as the authentication tag?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
6
$\begingroup$

What would the security problem be, if I just used the output of GHASH directly as the authentication tag?

Then someone listening into encrypted messages could recover $H$, one of which is correct.

The output of GHASH is a public polynomial (based on the ciphertext and the AAD), evaluated at a secret value $H$. It turns out that, given such a polynomial, $H$ can be efficiently recovered, either by rewriting the polynomial as $\mathrm{GHASH}(H) + \mathrm{Tag} = 0$, and recovering the roots of that (which can be done in a finite field), or even easier, getting two such ciphertexts, rewriting both of them, and use an Extended Euclidean value to recover their common root.

Given $H$, an attacker can trivially make arbitrary modifications to encrypted messages; yes, that's bad.

Improve this answer
$\endgroup$
12
  • $\begingroup$ One further question: Why is it necessary to use GCTR to encrypt the GHASH block instead of just using $Enc_H(GHASH)$ as the tag? That way, GMAC could be used without the need for an IV. $\endgroup$
    – mat
    Commented Apr 4, 2017 at 15:13
  • $\begingroup$ @mat: you mean sending $GHASH$ through AES (using $H$ as a key)? Well, actually, that sort of thing would work (well, I wouldn't use $H$ as a key, but other than that...) and would be a more conservative design; however GCM was originally designed to be a pipe-lineable mode; that is, it could be implemented given an AES hardware implementation where every clock cycle, we give the next plaintext block to the hardware, and every clock cycle, the ciphertext from 10-14 cycles ago pops out. By doing an encryption on the GHASH, we'd block the pipeline... $\endgroup$
    – poncho
    Commented Apr 4, 2017 at 15:37
  • $\begingroup$ I just mean a simple ECB encryption (using either $H$ or $K$ as the key) of the GHASH instead of doing it with GCTR. That would have the advantage, that GMAC would be easier to use, because it wouldn't need a nonce anymore. The pipelinig is not a problem here, since the encryption of the tag is the very last step beeing done in GCM anyway, so the pipeline is definitely empty at this stage. $\endgroup$
    – mat
    Commented Apr 5, 2017 at 9:23
  • 1
    $\begingroup$ @David天宇Wong: mostly performance (GHASH is parallizable, unkeyed hashes typically aren't) $\endgroup$
    – poncho
    Commented Mar 6, 2019 at 18:11
  • 1
    $\begingroup$ @David天宇Wong: oh, right, that too... $\endgroup$
    – poncho
    Commented Mar 6, 2019 at 18:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.