an introduction to authenticated encryption - iSEC Partners

M 1
M 2
•H
•H
Y 1
Y 2
. . .
M n
•H
Y n
Figure 3: GHASH Function
are then encrypted and XORed with each block of the message. The final result of these operations is returned as
the encrypted string C.
ICB inc CT R 2
. . . CT R n−1 inc CT R n
E k E k E k E k
M 1 M 2 M n−1 M ∗ n
C 1 C 2
. . . C n−1 C n
Figure 4: GCTR Function
The full GCM operation can be viewed as the superimposing of GCTR and GHASH as described above. The inputs
are the initialization vector IV, the key K, the message M (where the last block is represented by Mn ∗ which may not
be a full block length) and any authentication data A. The subkey H is calculated and the initial counter block (ICB)
is either the IV if the IV length is 96 bits, or the GHASH of the IV if the IV length is any value other than 96 bits.
The counter is incremented and each plaintext block is encrypted with the counter value. Each ciphertext block is
then multiplied by H and then XORed with the next block. The exception to this is that the encryption of the first
counter which is XORed with the last GHASH operation to create the authentication tag. The authentication only
data A is mixed in a similar manner. Decryption follows in the usual manner, where the encrypted counter values
are created and XORed with the ciphertext to produce the original message and then the GHASH in created.
GCM has the same requirements for uniqueness of the IV (i.e., the counter value) as traditional stream ciphers
and counter modes. Depending on the length of the IV either a counter or pseudo random number generator
based construction can be used for generation, but must never repeat. As is the case with other counter modes,
repeating the counter value for two messages breaks the confidentiality of those messages (i.e., an attacker can
learn M1 ⊕ M2); however, Ferguson and Joux have shown GCM suffers a more critical break in that a repeated IV
can lead to leakage of the authentication key.[12, 13] In addition, the use of a short authentication tag can increase
HTTPS://WWW.ISECPARTNERS.COM 6/10