 Like all counter modes, this is essentially a stream cipher, and so it is essential that a different IV is used for each stream that is encrypted.The ciphertext blocks are considered coefficients of a polynomial which is then evaluated at a key-dependent point , using finite field arithmetic.The result is then encrypted, producing an authentication tag that can be used to verify the integrity of the data.