I'm mainly trying to wrap my head around the pipeline of encryption, hashing and signing.
I've read over this question, describing the overhead of GCM, which I understand to be configurable for space-efficiency at the cost of security, but will be at most 196 bits.
This article by IETF, describing the overhead of TLS, appears to state that the GMAC/MAC is 128 bits long - which I'll understand as an average value
-----------------------------------------------------------------
AES_128_GCM, AES_256_GCM
-----------------------------------------------------------------
Per-packet overhead (TLS 1.0, 1.1, 1.2) 29 bytes
TLS header 5 bytes
Explicit Nonce 8 bytes
GMAC 16 bytes
-----------------------------------------------------------------
My first question is: If we're using the cyphersuite TLS_AES_128_GCM_SHA256; and GCM is using Encrypt-then-MAC (which appears to be always?) and is configured to use a 128-bit tag; and AES_128 is encrypting plaintext in blocks of 128 bits; then is GCM adding a 128-bit tag onto each one of those blocks (thus, halving the amount of cyphertext that can ultimately fit into the data payload of the L3 packet)? Or, is each tag XORed (or transformed in someway) into the next, to produce a single 128-bit tag (2) that is the result of all the previous operations?
The Wikipedia page for GCM repeatedly mentions "authentication", however it seems to be using it in place of "integrity" - ie. ensuring data hasn't been manipulated/corrupted in transit. I have a very basic understanding of the three types of EtM/MtE/EaM functions, of AEAD and of PKI... so my second (multi-part, sorry...) question is:
How/where exactly is SHA and RSA (or any signature algorithm) used in this process?
SHA I know to be a hashing algorithm - used in HKDF during the initial DHKE. It's also used to create small hashes/"fingerprints" of large pieces of data, such as Certificates - which I suppose are then signed by the private key of the private/public RSA key pair for the sake of "authenticating" each message/session.
(1) Is the RSA private key used to sign the tag/tags after they're generated, or are they used in the generation of the tags themselves?
(2) Is the RSA private key of the sender used to "sign" each tag of each block, or just the single 128-bit tag after the whole payload of plaintext is encrypted?
(3) Is the client signing hashes/MACs as well after communicating their public key, or is that usually only done by the server/owner of a signed RSA Certificate?
This thread seems to state that symmetric keys are used instead, but discussion kind of made me more confused.