This document defines the Galois Counter Mode with Secure Short Tags (GCM-SST) Authenticated Encryption with Associated Data (AEAD) algorithm. GCM-SST can be used with any keystream generator. Thus GCM-SST is a mode of operation of the Advanced Encryption Standard (AES). The main differences compared to GCM is that GCM-SST uses an additional subkey Q, that fresh subkeys H and Q are derived for each nonce, and that the POLYVAL function from AESGCM-SIV is used instead of GHASH. This enables short tags with forgery probabilities close to ideal.
Research areas