140-3 IG C.H Scenario 5. func NewGCMForHPKE(cipher *aes.Block) (*GCMWithXORCounterNon, error) { g, err := newGCM(&GCM{}, cipher, gcmStandardNonceSize, gcmTagSize) if err != nil { return nil, err } return &GCMWithXORCounterNon{g: *g}, nil } // NewGCMForQUIC returns a new AEAD that works like GCM, but enforces the // construction of nonces as specified in RFC 9001, Section 5.3. // // Unlike in TLS 1.3, the QUIC nonce counter does not always start at zero, as // the packet number does not reset on key...