[]byte) { c.XORKeyStreamAt(dst, src, c.offset) var carry uint64 c.offset, carry = bits.Add64(c.offset, uint64(len(src)), 0) if carry != 0 { panic("crypto/aes: counter overflow") } } // RoundToBlock is used by CTR_DRBG, which discards the rightmost unused bits at // each request. It rounds the offset up to the next block boundary. func RoundToBlock(c *CTR) { if remainder := c.offset % BlockSize; remainder != 0 { var carry uint64 c.offset, carry = bits.Add64(c.offset, BlockSize-remainder, 0) if carry...