paddedGHASH(H, &hash, lens[:]) copy(counter[:], hash[:]) } } // gcmAuth calculates GHASH(additionalData, ciphertext), masks the result // with tagMask and writes the result to out. func gcmAuth(out []byte, H *gcmHashKey, tagMask *[gcmBlockSize]byte, ciphertext, additionalData []byte) { var hash [16]byte paddedGHASH(H, &hash, additionalData) paddedGHASH(H, &hash, ciphertext) lens := gcmLengths(uint64(len(additionalData))*8, uint64(len(ciphertext))*8) paddedGHASH(H, &hash, lens[:]) copy(out, hash[:]) for...