# Where is the SIV in AES-GCM-SIV?

This is my understanding of Synthentic IVs

You have 2 keys $$K_1$$ & $$K_2$$.

$$F$$ is a PRF

Instead of choosing a separate IV, you instead generate the IV from the PlainText.

$$IV = F(K_1, m)$$
$$c = E(K_2, m, IV)$$

You don't need a separate Tag/Hash for authentication. Because the IV is generated using the PT itself, after decrypting the CT, you can generate the IV at the decryption end & check it it's same as IV send along with the CT.

I was looking at AES-GCM-SIV - https://tools.ietf.org/html/rfc8452

Here the IV seems to be passed as Input to the Encryption Algorithm & is not generated from the PT.

AES-GCM-SIV encryption takes a 16- or 32-byte key-generating key, a 96-bit nonce, and plaintext and additional data byte strings of variable length.

It also seems to produce a tag

Calculate S_s = POLYVAL(message-authentication-key, X_1, X_2, ...). XOR the first twelve bytes of S_s with the nonce and clear the most significant bit of the last byte. Encrypt the result with AES using the message-encryption key to produce the tag.

So why is this Encryption named as an SIV scheme?