Efficient authentication of large, dynamic data sets using Galois/counter mode (GCM)

The Galois/counter mode (GCM) of operation can be used as an incremental message authentication code (MAC); in this respect, it is unique among the crypto algorithms used in practice. We show that it has this property, and show how to efficiently recompute a MAC after small changes within a message, after the appending or prepending of data to a message, or the truncation of data from the start or end of a message. Incremental MACs have great utility for protecting data at rest. In particular, they can be used to protect a large, dynamic data set using only a small, constant amount of memory