Figure 105. Gcm Encryption And Authentication Principle; Figure 106. Gmac Authentication Principle - STMicroelectronics STM32WL5 Series Reference Manual

RM0453
Galois/counter mode (GCM)
key
Legend
In Galois/counter mode (GCM), the plaintext message is encrypted while a message
authentication code (MAC) is computed in parallel, thus generating the corresponding
ciphertext and its MAC (also known as authentication tag). It is defined in NIST Special
Publication 800-38D, Recommendation for Block Cipher Modes of Operation -
Galois/Counter Mode (GCM) and GMAC.
GCM mode is based on AES in counter mode for confidentiality. It uses a multiplier over a
fixed finite field for computing the message authentication code. It requires an initial value
and a particular 128-bit block at the end of the message.
Galois message authentication code (GMAC) principle
Legend
Galois message authentication code (GMAC) allows authenticating a message and
generating the corresponding message authentication code (MAC). It is defined in NIST
Special Publication 800-38D, Recommendation for Block Cipher Modes of Operation -
Galois/Counter Mode (GCM) and GMAC.

Figure 105. GCM encryption and authentication principle

Initialization
vector
key
Init
(Encrypt)
Plaintext block 1
H Ciphertext block 1
input
output
XOR

Figure 106. GMAC authentication principle

Initialization
vector
Plaintext block 1
key
Init
(Encrypt)
H
input
output
XOR
Counter +1 Counter
value
key
Encrypt Encrypt
Plaintext block 2
Ciphertext block 2
GF2mul GF2mul
Plaintext block 2
GF2mul GF2mul
RM0453 Rev 5
AES hardware accelerator (AES)
+1 Counter
value + 1 value + 2
key
Encrypt
Plaintext block 3
Ciphertext block 3
GF2mul
Final
Plaintext block 3
GF2mul
Final
TAG
MSv42143V1
TAG
MSv42144V1
653/1450
694