1
$\begingroup$

I've been looking into GHASH and some sites describe it as a polynomial:

A1*(H* *M-1)+A2*(H* *M-2)...C1*H(H* *M-N)+C2*H(H* *(M-N-1))...+len(A||C)*H+E(0)=t

while other sites replace the + with the XOR symbol, ^:

A1*(H* *M-1)^A2*(H* *M-2)...C1*H(H* *M-N)^C2*H(H* *(M-N-1))...^len(A||C)^H+E(0)=t

Which one is the correct one?

Improve this question
$\endgroup$
1

2 Answers 2

Reset to default
6
$\begingroup$

There is no difference in this context. XOR is sometimes called "carryless addition" because one bit addition mod 2 is identical to the one bit XOR operation. Multiplication is also carryless in this context.

Improve this answer
$\endgroup$
1
  • 1
    $\begingroup$ +1 for the term "carryless addition" which isn't present in Conrado's answer (which is an identical but more detailed answer). $\endgroup$
    – Maarten Bodewes ♦
    Commented May 12, 2018 at 1:32
6
$\begingroup$

GHASH operates on polynomials with coefficients in the two-element finite field $\operatorname{GF}(2)$ (which you can interpret as numbers modulo 2). Each coefficient is represented as a bit.

To add two of these polynomials you just need to add each pair of coefficients. Addition in $\operatorname{GF}(2)$ is the same as addition modulo 2, which is the same as xor. Therefore, to add two of these polynomials, you just need to compute the xor of their representations; that's why both "+" and "^" are used for the same operation.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.