nx_ghash_kat_test.nx

nx_ghash_kat_test.nx -- canonical KAT for the GHASH primitive using NIST SP 800-38D Appendix B Test Case 2 ("AES-128-GCM with 16-byte plaintext, all-zero IV"). Test Case 2 inputs (NIST published): K = 00000000000000000000000000000000 P = 00000000000000000000000000000000 (16-byte all-zero plaintext) AAD = (empty) IV = 000000000000000000000000 (12-byte all-zero IV) Derived intermediates: H = E_K(0^128) = 66e94bd4ef8a2c3b884cfa59ca342b2e C = ciphertext = 0388dace60b6a392f328c2b971b2fe78 GHASH(H, A=empty, C) = E_K(J0) XOR T where T = AB6E47D42CEC13BDF53A67B21257BDDF (the published tag). E_K(J0) where J0 = IV || 0^31 || 1 = 000000000000000000000000 00000001: E_K(J0) = 58e2fccefa7e3061367f1d57a4e7455a So GHASH = T XOR E_K(J0) = AB6E47D42CEC13BDF53A67B21257BDDF XOR 58e2fccefa7e3061367f1d57a4e7455a = F38CBB1AD692230AC3457AE5B6B0E885 We verify the GHASH output (NOT the tag) against that derived value. Inputs to ghash: A = empty, C = 0388dace60b6a392f328c2b971b2fe78. Length block = 0^64 || 16*8=128 = 00 00 00 00 00 00 00 00 || 00 00 00 00 00 00 00 80 expect_exit: 0. license_tier: ORIGINAL