subtle.ConstantTimeCompare(expectedTag[:g.tagSize], tag) != 1 { return errOpen } gcmCounterCryptGener(&g.cipher, out, ciphertext, &counter) return nil } // deriveCounterGeneric computes the initial GCM counter state from the given nonce. // See NIST SP 800-38D, section 7.1. This assumes that counter is filled with // zeros on entry. func deriveCounterGeneric(H, counter *[gcmBlockSize]byte, nonce []byte) { // GCM has two modes of operation with respect to the initial counter // state: a "fast path" for 96-bit...