# How AES-CTR is used in AES-GCM to generate cipherText and a authTag to authenticate the cipherText and authData?

Let,

Inputs:

key = key used to encrypt the plaintext.
IV = initialization vector.
plainText = plaintext need to be encrypted.
authData = addition data need to be authenticated which is not encrypted.


Outputs:

cipherText = encrypted plain text.
authTag = Authentication tag required to verify authenticity of cipherText and authData


Then,

cipherText = aes-ctr(key, IV+1, plainText);
authTag = AES-CTR(key, IV, keyDependentPoint-H(key, (cipherText-aes-ctr + authdata)));


Note: IV+1 is used for generating cipherText and the first IV is saved for encrypting the generated hash at later point of time when cipherText is generated.

am I doing any mistake?

This question is asked to ensure the above relation of AES-GCM with AES-CTR is correct and help others to understand AES-GCM in a simple and convincing way.

This question is derived from this question.

• What is not clear with the figure given in the ref link? AES-GCM mode is authenticated mode but CTR is not. GCM mode combines CTR for encryption and Galois Message Authentication Code (GMAC) for authentication. Dec 12 '18 at 14:06

AES-GCM,or more generally GCM is a mode of operation for a symmetric block cipher. It stands for Galois/Counter Mode. It provides Authenticated Encryption, guaranteeing both confidentiality (data secrecy) and integrity (data authenticity).

Confidentiality is provided by the Counter Mode: roughly a counter is encrypted and the output is xored with the plaintext. If more than one block has to be encrypted, the counter is incremented.

To be secure, GCM requires that the counter is used only once (See here for details Nonce reuse vulnerability). It is usually generated as the concatenantion of a NONCE and an actual counter (e.g.: $$NONCE || 0...0)$$.

Please note that the standard GCM construction uses the encryption of the counter from 1 to do the actual encryption, while the encryption of the zero-counter is used in the AuthTag computation

From a confidentiality point of view they are the same. Indeed, AES-GCM is defined as AES-CTR + GMAC as authentication code.

The difference is that AES-CTR does not provide integrity protection and an AuthTag has to be added (could be HMAC, or CBC-MAC for example); on the other side the AES-GCM provides both protection (confidentiality and integrity).

• AES-GCM is defined as AES-CTR + GMAC as authentication code. This is confusing as people may consider GMAC as a hash function. The other question could arise which cipher suite is used? as people may think a different cipher suite is used for GMAC. Dec 12 '18 at 14:27
• GMAC is only a MAC, Message Authentication Code. Dec 12 '18 at 14:38
• Yes. Agree........... Dec 12 '18 at 14:42
• @NayanKaran You might be thinking of GHASH. It's not the kind of hash you think it is. Dec 15 '18 at 12:02