I would like to use GCM/GMAC in next manner:
abcd|Tag0|efgh|Tag1|ijkl|Tag2| ... |wxyz|TagN
The nuance is each tag I gonna generate is not from its last block but the all previous plain- or cipher text preceding last tag. Otherwise speaking, last tag let authenticate the whole received stream, for example:
Tag0 authentifies 'abcd'
Tag1 authentifies 'abcdefgh'
Tag2 authentifies 'abcdefghijkl'
TagN authentifies 'abcdefghijkl...wxyz'
I know that xor`ing of two tags together discards H and gives you some info about the internal cipher context.
So, my questions are:
- Can xor`ed tags info be useful for any kind of attack?
- What weakness does this scheme have?
Update. The full scheme of how I want to use GCM/GMAC
- I have one randomly generated key
- I have one randomly IV
- I gonna encrypt and authenticate a bytestream of unknown length divided into blocks
- After each block I gonna produce an intermediate tag that should authenticate all previous bytes of the stream
- After intermediate tag generation, I gonna continue encryption flow further
Scheme from above with the single encryption function call may be considered as a scheme with separate calls but with the same Key, IV, and partially data.
Call 0:
'abcd'|Tag0
Call 1:
'abcdefgh'|Tag1
Call 2:
'abcdefghijkl'|Tag2
Call N:
'abcdefghijkl...wxyz'|TagN