ghash

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

While implementing GHASH support for the inside-secure driver and wondering why I couldn't get 
the test vectors to pass I have come to the conclusion that ghash-generic.c actually does *not*
implement GHASH at all. It merely implements the underlying chained GF multiplication, which,
I understand, is convenient as a building block for e.g. aes-gcm but is is NOT the full GHASH.
Most importantly, it does NOT actually close the hash, so you can trivially add more data to the
authenticated block (i.e. the resulting output cannot be used directly without external closing)

GHASH is defined as GHASH(H,A,C) whereby you do this chained GF multiply on a block of AAD
data padded to 16 byte alignment with zeroes, followed by a block of ciphertext padded to 16
byte alignment with zeroes, followed by a block that contains both AAD and cipher length.

See also https://en.wikipedia.org/wiki/Galois/Counter_Mode

Regards,
Pascal van Leeuwen
Silicon IP Architect, Multi-Protocol Engines @ Verimatrix
www.insidesecure.com





[Index of Archives]     [Kernel]     [Gnu Classpath]     [Gnu Crypto]     [DM Crypt]     [Netfilter]     [Bugtraq]

  Powered by Linux