I'm trying to make an GHASH() function and need some clarification. Implementation is based on gcm-spec. Page 8 describes polynomial mult and page 27 has a "Test Case 2" which I use to verify result.

From my understanding X1 is a first round of GHASH function and effectively a result of multiplication of 16B of ciphertext and 'H'. From test case

X1<-C * H
X1<= '0388dace60b6a392f328c2b971b2fe78' * '66e94bd4ef8a2c3b884cfa59ca342b2e'

My implementation gives a different result. I also have tried some online tools which gave a totally different numbers as well :(

So the question is do I got it right that X1 is a result of multH(C,H)?


  • $\begingroup$ give me the primitive polynomial that you used please $\endgroup$ Jun 1, 2021 at 14:29
  • 1
    $\begingroup$ @أكرم-آل-كرميش please never post a question as an answer. GCM always uses the polynomial $x^{128} + x^7 + x^2 + x + 1$. $\endgroup$
    – fgrieu
    Jun 1, 2021 at 15:50

1 Answer 1


Yes, you a right; also after running the GF(128)/GCM multiplication test I confirm that the product of the test values is

0x0388DACE60B6A392F328C2B971B2FE78 $\times$ 0x66E94BD4EF8A2C3B884CFA59CA342B2E = 0x5E2EC746917062882C85B0685353DEB7

  • 2
    $\begingroup$ Alright, nailed it. Need to get used to this reverse bit order of input bit stream. I used 0x80 mask to check for V[127]==0. While it's actually a LSB of a last byte and right mask is 0x01. Thanks, mate. $\endgroup$ Aug 22, 2018 at 0:29
  • $\begingroup$ 0x... usually indicates hexadecimal (Big Endian) notation, while the gcm-spec seems to run with hex dumps, i.e. leading digit pair refers to polynomial coefficients x^0 ... x^7, bit order is another story $\endgroup$ Aug 28, 2023 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.