Closed seceng-jan closed 8 months ago
Hi @seceng-jan
Thanks for trying the code and reporting this.
I honestly don't think that this is an issue. If you take a look at the NIST 800-38D, you will notice that the AAD is formed with the number of data to authenticate and a padding of zeros to reach the block size.
...In Steps 4 and 5, the AAD and the ciphertext are each appended with the minimum number of ‘0’ bits, possibly none, so that the bit lengths of the resulting strings are multiples of the block size.
This means that the user should supply the AAD already padded.
The reason why this doesn't happen for the data, is because I wrongly masked them.
In file gcm_gctr.vhd
line 162:
gctr_data_out <= (gctr_data_in_i xor aes_ecb_data) and gctr_data_mask;
should actually be:
gctr_data_out <= gctr_data_in_i xor (aes_ecb_data and gctr_data_mask);
Hope this makes sense. Luca
Hi Luca!
Thanks for the response. That does make sense. If you like, you can close this issue - don't know if you want to change gcm_gctr.vhd
first.
Best regards, Jan
HI!
Thanks for uploading the code, it helped me a lot! I believe there is a bug with the masking of the AAD input values. I found that when
the GCM tag is different to when I use
The first example returns the correct tag, the second one not. Here is my full testbench file: