A New Interpretation for the GHASH Authenticator of AES-GCM

AES-GCM authenticated encryption scheme has a significant role in modern secure communications. It combines AES CTR encryption with authentication that is based on a polynomial evaluation hash function (GHASH) computed in F2128[x]/PGCM(x), where P_GCM(x) = x¹²⁸+ x⁷+ x²+ x+ 1. AES-GCM operates on 128-bit strings: it views them as AES inputs/outputs for the encryption, and as elements in F2128 for the authentication. Unfortunately, the order of the bits, by which GHASH parses 128-bit strings as field elements is inconsistent with the way that AES uses 128-bit ciphertext/plaintext strings as arrays of 16 bytes. This leads to one of the following conclusions: a) GHASH does not operate directly on the ciphertext blocks. In this case, AES ciphertext blocks need to be bit-reflected before they are input to the GHASH computations; b) the field representation is not F2128[x]/PGCM(x). In this case, field multiplications are not directly expressed by polynomial arithmetic modulo P_GCM(x). The specification AES-GCM bypasses this discrepancy by describing the GHASH field operations as bit-level algorithms, rather than in terms of polynomial arithmetic, as expected. We resolve the inconsistency by introducing a description of GHASH that uses polynomial arithmetic in G=F2128[x]/(x128+x127+x126+x121+1). This formulation helps parsing 128-bit strings as AES inputs/outputs and as field elements, in a consistent manner. It also leads naturally to several recent AES-GCM software optimizations which are now already in use by leading open source cryptographic libraries.