Patent ID: 7970130

Claim:
A low-latency method of GHASH operation for Galois Counter Mode (GCM) executed in an authenticated encryption block cipher system, said GHASH operation having three inputs including authenticated data A and ciphertext C defined in said GCM, and HASH key H of said GHASH operation, said method comprising the steps of: formulating a final output X m+n+1 of said GHASH operation into a combination of three interim values X A , X C , and H n+1 , X A being an interim value related to said authenticated data A and expressed by X A =A 1 H m+1 ⊕A 2 H m ⊕ . . . ⊕( A m *∥S k−v ) H, and X C being an interim value related to said ciphertext C and expressed by X C =C 1 H n+1 ⊕C 2 H n ⊕ . . . ⊕( C n *∥S k−u ) H 2 ⊕( len ( A )∥ len ( C )) H; computing values of X A , X C , and H n+1 in parallel using computational units in said authenticated encryption block cipher system and completing said computing in max {m,n} computation cycles with each computation cycle being defined as a cycle of computational operations of (a⊕b)·c with a, b and c being three inputs of said computational operations; and computing a HASH value of said GHASH operation according to the values of X A , X C , and H n+1 using a computational unit in said authenticated encryption block cipher system; wherein said authenticated data A is divided into m blocks represented as A 1 , A 2 , . . . , A m−1 , A m *, said ciphertext C is divided into n blocks represented as C 1 , C 2 , . . . , C n−1 , C n *, S l is a binary string of l bits, v, u, and k are respective length values of A m *, C n * and H with u and v being both less than or equal to k, H n is a n-th computed value of H, len(A) and len(C) are respective length values of said authenticated data A and said ciphertext C, max {m,n} is a maximum value of m and n, ⊕ is an addition operation, and ∥ is a concatenation operation.