3 ms·

It is a composition. Some examples of non-composition schemes are sponge-based Keyak and NORX.

• klodolph 9y ago
  Which MAC does AES-GCM use? It's not GMAC, because GMAC would give different results...
  • dchest 9y ago
    It uses a Carter-Wegman MAC variant.
    • klodolph 9y ago
      A variant which only exists as part of the GCM standard, and has no name..
      • tptacek 9y ago
        GHASH only exists in the GCM standard too, but does have a name. This, too, is a silly point.