I've been reading the following document describing Galois Counter Mode: The Galois/Counter Mode of Operation

On page 7 of the document, the following diagram describes the GHASH function used to authenticate data. GHASH is defined as GHASH(H, A, C) where H is a 128-bit unsigned integer and A and C are two bit strings representing the authenticated data $A$ and ciphertext $C$. $m$ and $n$ are used to represent the number of 128 bit blocks of data in $A$ and $C$ respectively.


Equation 4 and 5 look incorrect to me. Is $C_i$ correct on line 4? Won't $i$ already be larger than $m$ and thus this won't include the correct blocks of $C$? Shouldn't this be $C_{i-m}$?

And the fifth equation, is this meant to be $C^{*}_{n}$ and not $C^{*}_{m}$?


Examining the document, it seems that you are correct on both equations. Thus

$$ C_i ~~\textrm{should be}~~C_{i-m}, $$


$$ C_m^* ~~\textrm{should be }C_n^*. $$


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.