![](https://csdnimg.cn/release/download_crawler_static/13018756/bg7.jpg)
NIST Special Publication 800-38D
Table of Contents
1 PURPOSE...........................................................................................................................................................1
2 AUTHORITY.....................................................................................................................................................1
3 INTRODUCTION..............................................................................................................................................1
4 DEFINITIONS, ABBREVIATIONS, AND SYMBOLS .................................................................................2
4.1 DEFINITIONS AND ABBREVIATIONS .............................................................................................................2
4.2 SYMBOLS ....................................................................................................................................................5
4.2.1 Variables................................................................................................................................................5
4.2.2 Operations and Functions .....................................................................................................................6
5 ELEMENTS OF GCM ......................................................................................................................................7
5.1 BLOCK CIPHER ............................................................................................................................................7
5.2 TWO GCM FUNCTIONS ...............................................................................................................................7
5.2.1 Authenticated Encryption Function .......................................................................................................8
5.2.2 Authenticated Decryption Function .......................................................................................................9
5.3 PRIMITIVES FOR CONFIDENTIALITY AND AUTHENTICATION........................................................................9
6 MATHEMATICAL COMPONENTS OF GCM...........................................................................................10
6.1 EXAMPLES OF BASIC OPERATIONS AND FUNCTIONS ON STRINGS .............................................................10
6.2 INCREMENTING FUNCTION ........................................................................................................................11
6.3 MULTIPLICATION OPERATION ON BLOCKS................................................................................................11
6.4 GHASH FUNCTION ...................................................................................................................................12
6.5 GCTR FUNCTION ......................................................................................................................................13
7 GCM SPECIFICATION .................................................................................................................................14
7.1 ALGORITHM FOR THE AUTHENTICATED ENCRYPTION FUNCTION..............................................................14
7.2 ALGORITHM FOR THE AUTHENTICATED DECRYPTION FUNCTION..............................................................16
8 UNIQUENESS REQUIREMENT ON IVS AND KEYS ..............................................................................18
8.1 KEY ESTABLISHMENT ...............................................................................................................................19
8.2 IV CONSTRUCTIONS ..................................................................................................................................19
8.2.1 Deterministic Construction..................................................................................................................20
8.2.2 RBG-based Construction .....................................................................................................................20
8.3 CONSTRAINTS ON THE NUMBER OF INVOCATIONS.....................................................................................21
9 PRACTICAL CONSIDERATIONS FOR VALIDATING IMPLEMENTATIONS .................................22
9.1 DESIGN CONSIDERATIONS.........................................................................................................................22
9.2 OPERATIONAL CONSIDERATIONS ..............................................................................................................23
10 CONFORMANCE ...........................................................................................................................................24
APPENDIX A: IMPORTANCE OF THE UNIQUENESS REQUIREMENT ON IVS .....................................25
APPENDIX B: AUTHENTICATION ASSURANCE ...........................................................................................26
APPENDIX C: REQUIREMENTS AND GUIDELINES FOR USING SHORT TAGS....................................28
APPENDIX D: PROTECTION AGAINST REPLAY OF MESSAGES .............................................................30
APPENDIX E: BIBLIOGRAPHY ..........................................................................................................................31
v