How does this POLYVAL modular reduction algorithm work?
From the paper if you look at section 2.3 you will find an explanation of the reduction. The reduction from a code execution prospective works by reducing the number of operations of GHASH.
From a theoretical stand point the paper authors took an incorrect derivation direction of the first induction proof. However their mistake resulted in discovering a differential set linkage between POLYVAL and GHASH.
Where A ^ B ---&gt;  D0  and Z* is the number of checks to determine the value of D0. After completing running GHASH the function returns D*. From this the operator can say B ---&gt; D0 and Z &lt; Z*.