How to handle the extra 12451 elements in Sophie-Germain Counter Mode?

Question

In Sophie-Germain Counter Mode (SGCM), the $GF(2^{128})$ field multiplication of Galois Counter Mode (GCM) is replaced with normal multiplication $\bmod 2^{128}+12451$. Because the block size is 128 bits, the extra 12451 elements of the group do not fit in the output.

The SGCM defining document says the following about the extra elements:

Should the value be equal to $2^{128}$ or larger and hence require more than 16 bytes of storage, the result should be truncated $\bmod 2^{128}$.

That is fine, due to the extremely small probability of wrapping, but there are other parts of the document that aren't straightforward.

The value of the multiplier/start point $H = E_k(0)+2$ prevents the pathological cases $H = 0$ and $H = 1$. ($H = -1$ is also prevented by the construction because $E_k(0)$ is too small.) But if $E_k(0)+2$ is either $2^{128}$ or $2^{128}+1$, what is supposed to happen to the math? Is supporting multiplying by a 129-bit number required to handle this case?

I was considering supporting both GCM and SGCM in a client-server application, with SGCM being used when the client is run on a machine without x86 pclmulqdq / ARM pmull. I don't think there are security considerations about supporting both based on the client's choice.

Answer 1

Should the value be equal to $2^{128}$ or larger and hence require more than 16 bytes of storage, the result should be truncated $\mod 2^{128}$

Note that this talks about the final tag value $Y_n$. Truncating the final value will reduce security, but only slightly (e.g. possibly doubling the success probability of a forgery attempt, which is tiny even with a doubling).

Truncating intermediate values could potentially greatly increase the potential for forgeries. At the very least, if you modify the proof giving a bound on the forgery probability, that bound will turn out to be 1 of a long (e.g. 2kbyte or longer) message. I'm not certain how one could construct such a forgery, but the entire point of (S)GCM is that there is provably no high probability method.

Is supporting multiplying by a 129-bit number required to handle this case?

Yup.

As an alternative, you might want to look up the Carter Wegman Counter mode; that is similar to SGCM, but uses the field $GF(2^{127}-1)$ (and divides the message into 15 byte blocks for the authentication pass).