counter[gcmBlockSize-1] = 1 } else { var hash [16]byte paddedGHASH(H, &hash, nonce) lens := gcmLengths(0, uint64(len(nonce))*8) paddedGHASH(H, &hash, lens[:]) copy(counter[:], hash[:]) } } // gcmAuth calculates GHASH(additionalData, ciphertext), masks the result // with tagMask and writes the result to out. func gcmAuth(out []byte, H *gcmHashKey, tagMask *[gcmBlockSize]byte, ciphertext, additionalData []byte) { var hash [16]byte paddedGHASH(H, &hash, additionalData) paddedGHASH(H, &hash, ciphertext) lens...