by TestCASTRejectionPat. It tests only one parameter set as // allowed by Note26. It tests the modified version of Algorithm 7 and 8 with a // fixed mu/μ, as allowed by IG 10.3.A, Resolution 15. It compares sk and not // pk, because H(pk) is part of sk, as allowed by the same Resolution. It // compares the results with hashes instead of values, to avoid embedding several // kilobytes of test vectors in every binary, as allowed by GeneralNote7. func fips140CAST() error { // From https://pages.nist...

encrypts plaintext to out, and writes a random nonce to // nonce. nonce must be 12 bytes, and out must be 16 bytes longer than plaintext. // out and plaintext may overlap exactly or not at all. additionalData and out // must not overlap. // // This complies with FIPS 140-3 IG C.H Scenario 2. // // Note that this is NOT a [cipher.AEAD].Seal method. func SealWithRandomNonce(g *GCM, nonce, out, plaintext, additionalData []byte) { if uint64(len(plaintext)) > uint64((1<<32)-2)*gcmBlockSize { panic("crypto/cipher:...