 This feature permits higher throughput than encryption algorithms, like CBC, which use chaining modes.The GF(2128) field used is defined by the polynomial

The authentication tag is constructed by feeding blocks of data into the GHASH function and encrypting the result.This GHASH function is defined by

where "H" = "Ek"(0128) is the Hash Key, a string of 128 zero bits encrypted using the block cipher, "A" is data which is only authenticated (not encrypted), "C" is the ciphertext, "m" is the number of 128-bit blocks in "A" (rounded up), "n" is the number of 128-bit blocks in "C" (rounded up), and the variable "Xi" for is defined below.