# AES-GCM GHASH calculation;

I'm trying to make an GHASH() function and need some clarification. Implementation is based on gcm-spec. Page 8 describes polynomial mult and page 27 has a "Test Case 2" which I use to verify result.

From my understanding X1 is a first round of GHASH function and effectively a result of multiplication of 16B of ciphertext and 'H'. From test case

X1<-C * H
X1<= '0388dace60b6a392f328c2b971b2fe78' * '66e94bd4ef8a2c3b884cfa59ca342b2e'


My implementation gives a different result. I also have tried some online tools which gave a totally different numbers as well :(

So the question is do I got it right that X1 is a result of multH(C,H)?

Thanks

• give me the primitive polynomial that you used please Jun 1, 2021 at 14:29
• @أكرم-آل-كرميش please never post a question as an answer. GCM always uses the polynomial $x^{128} + x^7 + x^2 + x + 1$.
– fgrieu
Jun 1, 2021 at 15:50

0x0388DACE60B6A392F328C2B971B2FE78 $\times$ 0x66E94BD4EF8A2C3B884CFA59CA342B2E = 0x5E2EC746917062882C85B0685353DEB7
• Alright, nailed it. Need to get used to this reverse bit order of input bit stream. I used 0x80 mask to check for V[127]==0. While it's actually a LSB of a last byte and right mask is 0x01. Thanks, mate. Aug 22, 2018 at 0:29