Tag
ghash
- Oct 6, 2025 GHASH and the Structure of a GCM Tag Why the authenticator is a polynomial evaluation in a binary field rather than a chained MAC, how the length block prevents padding ambiguity, and what tag truncation costs in forgery probability. cryptography
- May 19, 2025 Recovering the GCM Authentication Key from a Repeated Nonce Two messages encrypted under the same GCM nonce turn the tag difference into a polynomial in the hash subkey, whose roots yield the key and permit arbitrary forgery. cryptography