How does GCM/GMAC work? My question is simple: where is a good article to learn how GCM/GMAC works?
I mean not the description of the algorihm, but why this pair of algorithms for encryption/decryption is really inverse. For me it is not obvous, why encryption of (A+P) --> (C+T) followed by decyption gives again P and the same Tag T...
For me it is not obvous, why encryption of (A+P) --> (C+T) followed by decyption gives again P and the same Tag T...


Actually, the reason both sides get the same T is quite simple; GCM defines the tag as a function of the key, the nonce, the AAD (additional associated data) and the ciphertext.  This function happens to be something along the lines of "form a polynomial in $GF(2^{128})$ from the AAD and the ciphertext, evaluate that polynomial on a value $H$ which is a function of the key, and then add in an encryption of the nonce", however the details really aren't important for this question; what's important is that it is a determanistic function of those four things and nothing else.

When the encryptor produces the ciphertext, he computes this function (using his copy of the key, nonce and AAD), generating the tag.

When the decryptor receives the ciphertext, he also computes the function.  If the ciphertext was the same (that is, not modified in transit), and the nonce, AAD and the keys are also the same, then he'll compute the same tag (as he does the same function with the same inputs).