Generate $J_0$ for GCM cipher when $\operatorname{len}(IV) \neq 96$ bits I have the following questions about the construction of J0 when is not equal to 96 bits, $s= 128\big\lceil \operatorname{len}(\text{IV})/128\big\rceil-\operatorname{len}(\text{IV})$

For example if my IV is equal to 1, Calculating with Len would be 8-bit result, If we subtract, $\operatorname{len}(IV) / 128$ and calculating the result is 1 subtracted by 8 would be 7, Real number 1 or it is taken as 8-bit byte, and it would be and the rest would be 0?

And the 128 which is outside what is the function, multiply? And read the steps, but reading the explanation of the document and reading the formulas confuses me.

If $\operatorname{len}(\text{IV}) ≠ 96$, then let 
$s= 128\big\lceil \operatorname{len}(\text{IV})/128 \big\rceil-\operatorname{len}(\text{IV})$, and let 
$J_0=\operatorname{GHASH}(\text{IV}||0s+64||[\operatorname{len}(\text{IV})]64)$.
Yes, the initial 128 is multiplication and it is performed before the subtraction.

OK, so if $\operatorname{len}(IV) = 1$ in bits then $$s= 128\big\lceil\operatorname{len}(IV)/128\big\rceil-\operatorname{len}(IV)$$ would be $$s= 128 \cdot 1 - 1 = 128 - 1 = 127$$

However, if you encode it as a single byte then $$s= 128 \cdot 1 - 8 = 128 - 8 = 120$$.

Note that any IV size between 0 exclusive and 128 inclusive will let $\big\lceil \operatorname{len}(IV)/128\big\rceil$ evaluate to 1, as the division result is in between 0 exclusive and 1 inclusive.

The IV is generally delivered as byte array as implementations generally do not operate on bits, even if the speficiation does specify the algorithm in bits. So generally delivering just one bit is not possible. This means that the most significant (leftmost bits) of the byte or bytes are included in the calculation even if they set to 0. The IV is handled as a string of bits, not as a number within the specification. So lets assume a single byte with value 00000001 in bits.



For the second part of the scheme to calculate $J_0$ we have $$J_0=\operatorname{GHASH}_H(IV||0^{s+64}||\big[\operatorname{len}(IV)\big]_{64})$$ which means the $\operatorname{GHASH}$ using $H$ over the one byte IV concatenated by $s + 64$ bits (184 bits or 23 bytes) set to zero and then the length of the IV created as static, big endian unsigned encoding of 8 bytes. If you combine the sizes of the fields you'll get a nice 32 bytes: $1 + 23 + 8 = 32$, which is handled perfectly well by GHASH that requires 128 bit / 16 byte block size.

The result will be, the GHASH over (in hexadecimals, two characers per byte):

01_000000_00000000 00000000_00000000 00000000_00000000 00000000_00000001