From what I've read in section 5.3 of NIST 800-38D it states:
The hash subkey, denoted H, is generated by applying the block cipher to the “zero” block.
In serious crypto J.P Aumasson describes the implementation of it as H = AES(K,0)
for a single block of zeros, hence no block chaining mode, hence no IV as I understand it. Therefore the mapping between H
and K
should be universally constant.
The book notes:
In GCM, GHASH doesn't use K directly in order to ensure that if GHASH's key is compromised, the master key K remains secret. Given K, you can get H by computing AES(K,0), but you can't recover K from that value since K acts as AES's key.
If the mapping is universally constant wouldn't it be the case that this could be pre-computed and available somewhere? (I wanted to say rainbow table here, but that probably doesn't quite apply based on what I read in this response)
So is the strength just that storing this permutation space for later indexing is thought to be too large? Or is there more to it that what I laid out?