panic("crypto/cipher: incorrect nonce length given to GCM") } counter := byteorder.BEUint64(nonce[len(nonce)-8:]) if !g.ready { // In the first call, the counter is zero, so we learn the XOR mask. g.ready = true g.mask = counter } counter ^= g.mask // Ensure the counter is monotonically increasing. if counter == math.MaxUint64 { panic("crypto/cipher: counter wrapped") } if counter < g.next { panic("crypto/cipher: counter decreased") } g.next = counter + 1 fips140.RecordApproved() return g.g.sealAfterIndicator(dst,...