roved() var out [gcmBlockSize]byte ghash(&out, key, inputs...) return out[:] } // ghash is a variable-time generic implementation of GHASH, which shouldn't // be used on any architecture with hardware support for AES-GCM. // // Each input is zero-padded to 128-bit before being absorbed. func ghash(out, H *[gcmBlockSize]byte, inputs ...[]byte) { // productTable contains the first sixteen powers of the key, H. // However, they are in bit reversed order. var productTable [16]gcmFieldElement // We precompute...