# GCM optimisation using $M_0$ and $R$ tables - Calculation of $R$

I'm implementing GCM in C as a way to learn about it. In the paper titled as The Galois/Counter Mode of Operation (GCM) by McGrew and Viega on chapter 4.1, page 11, 12, they talk about the optimisation of GCM via usage of the tables $$M_0$$ and $$R$$. What I'm not understanding is how to calculate the table $$R$$, which shall contain the products of $$x \cdot P^{128}$$.

The Paper doesn't go more in depth about it, can some of you help me with my understanding of it?

• I'm sorry that I forgot that, its chapter 4.1, the short text about $R$ is in the last paragraph on page 11 and at the start of page 12. – Colipedia Feb 27 '19 at 12:02

$$P$$, defined on p. 8, is a representation of a primitive element in $$\operatorname{GF}(2^{128})$$; specifically, if we represent the field by $$\operatorname{GF}(2)[t]/(f)$$ where $$f = t^{128} + t^7 + t^2 + t + 1$$, $$P$$ represents the polynomial $$t$$, i.e. $$0 + t + 0 t^2 + 0 t^3 + \cdots + 0 t^{127}$$.
If $$x$$ is a byte, represented as some polynomial in $$\operatorname{GF}(2)[t]$$, then there are only 256 possible values of $$x$$. The table $$x\cdot P^{128}$$ maps each possible byte to the corresponding polynomial $$x\cdot t^{128}$$ reduced modulo $$f$$.