So. As I understand, Carter-Wegman transforms a one-time MAC (which must be a difference unpredictable function (DUF)) by encrypting it with a PRF.
The DUF and the PRF use two different keys, which can be understandable if:
- you're just being precautious and not mixing keys
- the PRF and the DUF might take keys of different sizes/format
Now, AES-GCM uses AES and GHASH which both take keys of size 128-bit. So why don't they use the same key?