New answers tagged gcm
0
Indeed $H=E_k(0)$ is used to choose from the family. This is not a problem, and here is some intuition on why.
The output of the hash function is not leaked in clear, it is "hidden" by xoring with $E_k(iv,ctr=0)$ which is different per each encrypted message (in contrast to $H=E_k(0)$). Otherwise it would be indeed trivial to recover H as the UHF ...
0
I've used Algorithm 3 of the paper for this purpose.
$M[128] ← e1||0^{120} $ instead of H
$P ← 04||0^{120} $ which is 2 with reverse bits
0
The polynomial f would be 0xe1, no?
it is $e1 \mathbin \|0^{120}$ i.e. 0xe1000000000000000000000000000000
What would be the value of the element P, if it corresponds to the polynomial α?
it is 2 reversed i.e. 0x40000000000000000000000000000000
Top 50 recent answers are included
