gcmLengths(uint64(len(additionalData))*8, uint64(len(ciphertext))*8) paddedGHASH(H, &hash, lens[:]) copy(out, hash[:]) for i := range out { out[i] ^= tagMask[i] } } func seal(out []byte, g *GCM, nonce, plaintext, data []byte) { switch { case useGCM: sealKMA(out, g, nonce, plaintext, data) case useGHASH: sealAsm(out, g, nonce, plaintext, data) default: sealGeneric(out, g, nonce, plaintext, data) } } func sealAsm(out []byte, g *GCM, nonce, plaintext, additionalData []byte) { var counter, tagMask [gcmBlockSize]byte...