GHASH is the keyed hashing component behind GMAC, the authentication half of AES-GCM. It is an almost-XOR-universal hash: unlike a collision-resistant hash, it needs only a weaker unpredictability property, allowing faster authentication. section 4.5.2
GHASH fits into AES-GCM in several steps:
- Split input into 16-byte blocks and absorb them in a CBC-like process to produce a 16-byte digest. section 4.5.2
- Treat the keyed digest as a one-time MAC; Wegman-Carter processing turns it into a many-time MAC. section 4.5.2
- Encrypt the GHASH result with AES-CTR and a different key to create the GMAC authentication tag. section 4.5.2
Figure 4.15 GHASH takes a key and absorbs the input block by block in a manner resembling CBC mode. It produces a digest of 16 bytes.
The block diagram makes GHASH’s CBC-like, 16-byte absorption process concrete. section 4.5.2
Figure 4.16 GMAC uses GHASH with a key to hash the input, then encrypts it with a different key and AES-CTR to produce an authentication tag.
The GMAC diagram shows how GHASH combines with AES-CTR to produce an authentication tag. section 4.5.2
Nonce uniqueness is critical: reusing a nonce can expose GHASH’s authentication key and make tag forgery easy. section 4.5.2
