GHASH is used essentially only in AES-GCM. The ghash tag was introduced in late 2018 and applies to only five questions all asked within the span of one week. In contrast, there are over seventy tagged aes-gcm and over two hundred tagged gcm. Do we really need three different tags ghash, gcm, and aes-gcm?
No. We should merge all three into gcm.
Looking quickly at the use of aes-gcm, I see mostly or only questions that are about GCM, where the block cipher itself is secondary or irrelevant. Furthermore, AES-GCM derives its properties from AES and GCM; I can't think of a question that is specifically about AES-GCM and not about one or both of AES-GCM. So the tag aes-gcm should not exist, most questions currently tagged aes-gcm should have the tag gcm instead, but maybe a few should also have the tag aes.
GHASH is only used in the context of GCM in practice, but in principle it could be used independently (and arguably it is when you use GCM with an empty plaintext). Furthermore GHASH is a somewhat specific aspect of GCM. Looking at its usage, I see some distinction between gcm and ghash questions: most gcm questions are about using GCM as a black box, whereas ghash questions are about the design of GHASH. Therefore I think ghash should stay, and should be applied to a few more questions (which can happen organically).
Therefore I propose the following actions:
Yes, we really need three different tags.
- ghash could conceivably be used/discussed outside of the context of aes-gcm
- gcm could conceivably be discussed in conjunction with a cipher other than AES