High performance GHASH and impacts of a class of unconventional bases

Abstract

This work presents a new method to compute the GHASH function involved in the Galois/Counter Mode of operation for block ciphers. If ${X= X_1\ldots X_n}$ is a bit string made of n blocks of 128 bits each, then the GHASH function essentially computes ${X_1H^n + X_2H^{n-1} + \cdots+ X_nH}$ , where H is the hash key and an element of the binary field ${\mathbb{F}_{2^{128}}}$ . This operation is usually computed using n successive multiply-and-add operations over ${\mathbb{F}_{2^{128}}}$ . Our proposed method replaces all but a fixed number of those multiplications by additions on the field. This is achieved using the characteristic polynomial of H. We present both how to use this polynomial to speed up the GHASH function and how to efficiently compute it for each session that uses a new H. We also show that the proposed technique can be parallelized to compute GHASH even faster. In order to completely eliminate the need for a field multiplication, we investigate a different set of bases for the field element representation and report their architectural and possible security impacts.