v.high & 1. type gcmFieldElement struct { low, high uint64 } // GHASH is exposed to allow crypto/cipher to implement non-AES GCM modes. // It is not allowed as a stand-alone operation in FIPS mode because it // is not ACVP tested. func GHASH(key *[16]byte, inputs ...[]byte) []byte { fips140.RecordNonApproved() var out [gcmBlockSize]byte ghash(&out, key, inputs...) return out[:] } // ghash is a variable-time generic implementation of GHASH, which shouldn't // be used on any architecture with hardware...