1
$\begingroup$

I've been looking into GHASH and some sites describe it as a polynomial:

A1*(H* *M-1)+A2*(H* *M-2)...C1*H(H* *M-N)+C2*H(H* *(M-N-1))...+len(A||C)*H+E(0)=t

while other sites replace the + with the XOR symbol, ^:

A1*(H* *M-1)^A2*(H* *M-2)...C1*H(H* *M-N)^C2*H(H* *(M-N-1))...^len(A||C)^H+E(0)=t

Which one is the correct one?

$\endgroup$
6
$\begingroup$

There is no difference in this context. XOR is sometimes called "carryless addition" because one bit addition mod 2 is identical to the one bit XOR operation. Multiplication is also carryless in this context.

$\endgroup$
  • 1
    $\begingroup$ +1 for the term "carryless addition" which isn't present in Conrado's answer (which is an identical but more detailed answer). $\endgroup$ – Maarten - reinstate Monica May 12 '18 at 1:32
6
$\begingroup$

GHASH operates on polynomials with coefficients in the two-element finite field $\operatorname{GF}(2)$ (which you can interpret as numbers modulo 2). Each coefficient is represented as a bit.

To add two of these polynomials you just need to add each pair of coefficients. Addition in $\operatorname{GF}(2)$ is the same as addition modulo 2, which is the same as xor. Therefore, to add two of these polynomials, you just need to compute the xor of their representations; that's why both "+" and "^" are used for the same operation.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.