GCM mode and the order of AAD and plaintext In GCM mode of encryption, what are the limitations on the mixing of plaintext and AAD (additional authenticated data)?


Must the AAD come before the plaintext? Or could it be after the plaintext instead?
Could there be both a block of AAD before the plaintext, and another block of AAD after the plaintext?
Is it possible for AAD and plaintext to be interleaved in some more complicated way?
To extend Conrado's answer, there are three possible ways you might mean ordering:


The order of things location within memory
The order you present things to the GCM implementation
The order of coefficients within the GHASH polynomial


As Conrado mentioned, it doesn't matter where things appear in memory.

And, the order of coefficents are defined within GCM; change the order, and you're no longer doing GCM.  It might be secure (depending on the details of your new scheme), but it's not GCM

On the other hand, there are tricks that allow you to process things in a different order than how they appear in the polynomial.

For example, you can rearrange the GHASH polynomial to be:

$$(A_a H^a + A_{a-1} H^{a-1} + ... + A_0 H^0) H^{m+3} + \\ (M_m H^m + M_{m-1}H^{m-1} + ... + M_0H^0)H^2 +\\ TH$$

(where the AAD block is $(A_a, A_{a-1}, ..., A_0)$, the message is $(M_m, M_{m-1}, ..., M_0)$ is the message and $T$ is the block containing the AAD and message lengths)

With this formulation, you can process the AAD and the message independently, and combine them at the end.

Standard libraries don't implement this, but it certainly could be done.