Module gcm 

AES-256-GCM with a 16-byte nonce and no associated data: the attachment cipher (0xChat-compatible). A stitched AES-NI/PCLMULQDQ engine where it has been measured to win, RustCrypto’s ctr + ghash everywhere else; both produce the same bytes.

Structs

Stream

One GCM message fed in chunks. Every chunk but the last must be a multiple of 16 bytes: GHASH may only pad the final block.

TagMismatch

The tag did not authenticate the ciphertext.

Constants

TAG_LEN

Functions

open

Open data in place. On a bad tag the buffer is wiped, so no unauthenticated plaintext survives the call.

seal

Seal data in place and return the tag.

tags_equal

Every byte compared, whatever the first difference.