x⁶³ can be obtained by v.low & 1. // the coefficient of x⁶⁴ can be obtained by v.high >> 63. // the coefficient of x¹²⁷ can be obtained by v.high & 1. type gcmFieldElement struct { low, high uint64 } // GHASH is exposed to allow crypto/cipher to implement non-AES GCM modes. // It is not allowed as a stand-alone operation in FIPS mode because it // is not ACVP tested. func GHASH(key *[16]byte, inputs ...[]byte) []byte { fips140.RecordNonApproved() var out [gcmBlockSize]byte ghash(&out, key, inputs...)...