1

I've been looking into GHASH and some sites describe it as a polynomial:

A1*(H* *M-1)+A2*(H* *M-2)...C1*H(H* *M-N)+C2*H(H* *(M-N-1))...+len(A||C)*H+E(0)=t

while other sites replace the + with the XOR symbol, ^:

A1*(H* *M-1)^A2*(H* *M-2)...C1*H(H* *M-N)^C2*H(H* *(M-N-1))...^len(A||C)^H+E(0)=t

Which one is the correct one?

Maarten Bodewes
  • 96,351
  • 14
  • 169
  • 323
Itai
  • 19
  • 1

2 Answers2

6

There is no difference in this context. XOR is sometimes called "carryless addition" because one bit addition mod 2 is identical to the one bit XOR operation. Multiplication is also carryless in this context.

Future Security
  • 3,381
  • 1
  • 10
  • 26
6

GHASH operates on polynomials with coefficients in the two-element finite field $\operatorname{GF}(2)$ (which you can interpret as numbers modulo 2). Each coefficient is represented as a bit.

To add two of these polynomials you just need to add each pair of coefficients. Addition in $\operatorname{GF}(2)$ is the same as addition modulo 2, which is the same as xor. Therefore, to add two of these polynomials, you just need to compute the xor of their representations; that's why both "+" and "^" are used for the same operation.

Squeamish Ossifrage
  • 49,816
  • 3
  • 122
  • 230
Conrado
  • 6,614
  • 1
  • 30
  • 45