5
Latency, probably.
$\mathrm{GHASH}_K(m) \oplus \mathrm{AES}_K(n)$ lets you compute both in parallel, whereas encrypting the $\mathrm{GHASH}$ output would add significant latency for short messages. The authors go to great detail about this in Section 3 of the original GCM document.
A similar competing mode at the time, CWC, did indeed encrypt the MAC ...
2
It's a translation of $ed \equiv 1 \pmod{\phi(N)}$, namely that $e$ and $d$ are each other's inverse modulo $\phi(N)$, which says that $ed-1$ must be an integer multiple of $\phi(N)$ (recall that $a \equiv b \pmod{c}$ iff $c$ divides $b-a$ in the integers iff $b-a=lc$ for some integer $l$) and some some $k \in \Bbb Z$ exists with $k\phi(N) = ed-1$ (as an ...
Only top voted, non community-wiki answers of a minimum length are eligible
