1
$\begingroup$

I'm trying to make an GHASH() function and need some clarification. Implementation is based on gcm-spec. Page 8 describes polynomial mult and page 27 has a "Test Case 2" which I use to verify result.

From my understanding X1 is a first round of GHASH function and effectively a result of multiplication of 16B of ciphertext and 'H'. From test case

X1<-C * H
X1<= '0388dace60b6a392f328c2b971b2fe78' * '66e94bd4ef8a2c3b884cfa59ca342b2e'

My implementation gives a different result. I also have tried some online tools which gave a totally different numbers as well :(

So the question is do I got it right that X1 is a result of multH(C,H)?

Thanks

| improve this question | |
$\endgroup$
1
$\begingroup$

Yes, you a right; also after running the GF(128)/GCM multiplication test I confirm that the product of the test values is

0x0388DACE60B6A392F328C2B971B2FE78 $\times$ 0x66E94BD4EF8A2C3B884CFA59CA342B2E = 0x5E2EC746917062882C85B0685353DEB7

| improve this answer | |
$\endgroup$
  • 1
    $\begingroup$ Alright, nailed it. Need to get used to this reverse bit order of input bit stream. I used 0x80 mask to check for V[127]==0. While it's actually a LSB of a last byte and right mask is 0x01. Thanks, mate. $\endgroup$ – user3124812 Aug 22 '18 at 0:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.