masks the result with // tagMask and writes the result to out. func auth(out, ciphertext, aad []byte, tagMask *[gcmTagSize]byte, productTable *[256]byte) { var hash [16]byte paddedGHASH(&hash, aad, productTable) paddedGHASH(&hash, ciphertext, productTable) lens := gcmLengths(uint64(len(aad))*8, uint64(len(ciphertext))*8) paddedGHASH(&hash, lens[:], productTable) copy(out, hash[:]) for i := range out { out[i] ^= tagMask[i] } } func seal(out []byte, g *GCM, nonce, plaintext, data []byte) { if !supportsAESGCM...