Why is the GHASH output in GCM mode encrypted to calculate the tag? To calculate the authentication tag in the Galois/Counter mode (GCM), first a MAC is calculated using GHASH over the cipher text and the additional data. After that, this MAC is encrypted using GCTR (using the first counter).

My question is: Why is this last encryption step neccesary? What would the security problem be, if I just used the output of GHASH directly as the authentication tag?
What would the security problem be, if I just used the output of GHASH directly as the authentication tag?


Then someone listening into encrypted messages could recover $H$, one of which is correct.

The output of GHASH is a public polynomial (based on the ciphertext and the AAD), evaluated at a secret value $H$.  It turns out that, given such a polynomial, $H$ can be efficiently recovered, either by rewriting the polynomial as $\mathrm{GHASH}(H) + \mathrm{Tag} = 0$, and recovering the roots of that (which can be done in a finite field), or even easier, getting two such ciphertexts, rewriting both of them, and use an Extended Euclidean value to recover their common root.

Given $H$, an attacker can trivially make arbitrary modifications to encrypted messages; yes, that's bad.