&GCMWithXORCounterNon{g: *g}, nil } // NewGCMForQUIC returns a new AEAD that works like GCM, but enforces the // construction of nonces as specified in RFC 9001, Section 5.3. // // Unlike in TLS 1.3, the QUIC nonce counter does not always start at zero, as // the packet number does not reset on key updates, so the XOR mask must be // provided explicitly instead of being learned on the first Seal call. Note // that the nonce passed to Seal must already be XOR'd with the IV, the IV is // provided here only to allow...