g, err := newGCM(&GCM{}, cipher, gcmStandardNonceSize, gcmTagSize) if err != nil { return nil, err } return &GCMWithXORCounterNon{g: *g}, nil } // NewGCMForHPKE returns a new AEAD that works like GCM, but enforces the // construction of nonces as specified in RFC 9180, Section 5.2. // // This complies with FIPS 140-3 IG C.H Scenario 5. func NewGCMForHPKE(cipher *aes.Block) (*GCMWithXORCounterNon, error) { g, err := newGCM(&GCM{}, cipher, gcmStandardNonceSize, gcmTagSize) if err != nil { return nil,...