Masking of AAD Input Value about aes-gcm-128-192-256-bits HOT 3 CLOSED

Hi @seceng-jan

Thanks for trying the code and reporting this.

I honestly don't think that this is an issue. If you take a look at the NIST 800-38D, you will notice that the AAD is formed with the number of data to authenticate and a padding of zeros to reach the block size.

...In Steps 4 and 5, the AAD and the ciphertext are each appended with the minimum number of ‘0’ bits, possibly none, so that the bit lengths of the resulting strings are multiples of the block size.

This means that the user should supply the AAD already padded.

The reason why this doesn't happen for the data, is because I wrongly masked them.
In file gcm_gctr.vhd line 162:
gctr_data_out <= (gctr_data_in_i xor aes_ecb_data) and gctr_data_mask;

should actually be:
gctr_data_out <= gctr_data_in_i xor (aes_ecb_data and gctr_data_mask);

Hope this makes sense.
Luca

from aes-gcm-128-192-256-bits.

Hi Luca!

Thanks for the response. That does make sense. If you like, you can close this issue - don't know if you want to change gcm_gctr.vhd first.

Best regards,
Jan

from aes-gcm-128-192-256-bits.

Although this wasn't an issue, I preferred to add the logic that masks the AAD and Data that are supplied to the GHASH block. This will avoid other users to end up into this issue.
Commit can be found here

from aes-gcm-128-192-256-bits.