gcm128.c

		    GHASH(ctx,out-j,j);
		}
#else
		while (len>=16) {
		    	size_t *out_t=(size_t *)out;
		    	const size_t *in_t=(const size_t *)in;

			(*block)(ctx->Yi.c,ctx->EKi.c,key);
			++ctr;
			if (is_endian.little)
#ifdef BSWAP4
				ctx->Yi.d[3] = BSWAP4(ctr);
#else
				PUTU32(ctx->Yi.c+12,ctr);
#endif
			else
				ctx->Yi.d[3] = ctr;
			for (i=0; i<16/sizeof(size_t); ++i)
				ctx->Xi.t[i] ^=
				out_t[i] = in_t[i]^ctx->EKi.t[i];
			GCM_MUL(ctx,Xi);
			out += 16;
			in  += 16;
			len -= 16;
		}
#endif
		if (len) {
			(*block)(ctx->Yi.c,ctx->EKi.c,key);
			++ctr;
			if (is_endian.little)
#ifdef BSWAP4
				ctx->Yi.d[3] = BSWAP4(ctr);
#else
				PUTU32(ctx->Yi.c+12,ctr);
#endif
			else
				ctx->Yi.d[3] = ctr;
			while (len--) {
				ctx->Xi.c[n] ^= out[n] = in[n]^ctx->EKi.c[n];
				++n;
			}
		}

		ctx->mres = n;
		return 0;
	} while(0);
#endif
	for (i=0;i<len;++i) {
		if (n==0) {
			(*block)(ctx->Yi.c,ctx->EKi.c,key);
			++ctr;
			if (is_endian.little)
#ifdef BSWAP4
				ctx->Yi.d[3] = BSWAP4(ctr);
#else
				PUTU32(ctx->Yi.c+12,ctr);
#endif
			else
				ctx->Yi.d[3] = ctr;
		}
		ctx->Xi.c[n] ^= out[i] = in[i]^ctx->EKi.c[n];
		n = (n+1)%16;
		if (n==0)
			GCM_MUL(ctx,Xi);
	}

	ctx->mres = n;
	return 0;
}

int CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx,
		const unsigned char *in, unsigned char *out,
		size_t len)
{
	const union { long one; char little; } is_endian = {1};
	unsigned int n, ctr;
	size_t i;
	u64        mlen  = ctx->len.u[1];
	block128_f block = ctx->block;
	void      *key   = ctx->key;
#ifdef GCM_FUNCREF_4BIT
	void (*gcm_gmult_p)(u64 Xi[2],const u128 Htable[16])	= ctx->gmult;
# ifdef GHASH
	void (*gcm_ghash_p)(u64 Xi[2],const u128 Htable[16],
				const u8 *inp,size_t len)	= ctx->ghash;
# endif
#endif

	mlen += len;
	if (mlen>((U64(1)<<36)-32) || (sizeof(len)==8 && mlen<len))
		return -1;
	ctx->len.u[1] = mlen;

	if (ctx->ares) {
		/* First call to decrypt finalizes GHASH(AAD) */
		GCM_MUL(ctx,Xi);
		ctx->ares = 0;
	}

	if (is_endian.little)
#ifdef BSWAP4
		ctr = BSWAP4(ctx->Yi.d[3]);
#else
		ctr = GETU32(ctx->Yi.c+12);
#endif
	else
		ctr = ctx->Yi.d[3];

	n = ctx->mres;
#if !defined(OPENSSL_SMALL_FOOTPRINT)
	if (16%sizeof(size_t) == 0) do {	/* always true actually */
		if (n) {
			while (n && len) {
				u8 c = *(in++);
				*(out++) = c^ctx->EKi.c[n];
				ctx->Xi.c[n] ^= c;
				--len;
				n = (n+1)%16;
			}
			if (n==0) GCM_MUL (ctx,Xi);
			else {
				ctx->mres = n;
				return 0;
			}
		}
#if defined(STRICT_ALIGNMENT)
		if (((size_t)in|(size_t)out)%sizeof(size_t) != 0)
			break;
#endif
#if defined(GHASH) && defined(GHASH_CHUNK)
		while (len>=GHASH_CHUNK) {
		    size_t j=GHASH_CHUNK;

		    GHASH(ctx,in,GHASH_CHUNK);
		    while (j) {
		    	size_t *out_t=(size_t *)out;
		    	const size_t *in_t=(const size_t *)in;

			(*block)(ctx->Yi.c,ctx->EKi.c,key);
			++ctr;
			if (is_endian.little)
#ifdef BSWAP4
				ctx->Yi.d[3] = BSWAP4(ctr);
#else
				PUTU32(ctx->Yi.c+12,ctr);
#endif
			else
				ctx->Yi.d[3] = ctr;
			for (i=0; i<16/sizeof(size_t); ++i)
				out_t[i] = in_t[i]^ctx->EKi.t[i];
			out += 16;
			in  += 16;
			j   -= 16;
		    }
		    len -= GHASH_CHUNK;
		}
		if ((i = (len&(size_t)-16))) {
		    GHASH(ctx,in,i);
		    while (len>=16) {
		    	size_t *out_t=(size_t *)out;
		    	const size_t *in_t=(const size_t *)in;

			(*block)(ctx->Yi.c,ctx->EKi.c,key);
			++ctr;
			if (is_endian.little)
#ifdef BSWAP4
				ctx->Yi.d[3] = BSWAP4(ctr);
#else
				PUTU32(ctx->Yi.c+12,ctr);
#endif
			else
				ctx->Yi.d[3] = ctr;
			for (i=0; i<16/sizeof(size_t); ++i)
				out_t[i] = in_t[i]^ctx->EKi.t[i];
			out += 16;
			in  += 16;
			len -= 16;
		    }
		}
#else
		while (len>=16) {
		    	size_t *out_t=(size_t *)out;
		    	const size_t *in_t=(const size_t *)in;

			(*block)(ctx->Yi.c,ctx->EKi.c,key);
			++ctr;
			if (is_endian.little)
#ifdef BSWAP4
				ctx->Yi.d[3] = BSWAP4(ctr);
#else
				PUTU32(ctx->Yi.c+12,ctr);
#endif
			else
				ctx->Yi.d[3] = ctr;
			for (i=0; i<16/sizeof(size_t); ++i) {
				size_t c = in[i];
				out[i] = c^ctx->EKi.t[i];
				ctx->Xi.t[i] ^= c;
			}
			GCM_MUL(ctx,Xi);
			out += 16;
			in  += 16;
			len -= 16;
		}
#endif
		if (len) {
			(*block)(ctx->Yi.c,ctx->EKi.c,key);
			++ctr;
			if (is_endian.little)
#ifdef BSWAP4
				ctx->Yi.d[3] = BSWAP4(ctr);
#else
				PUTU32(ctx->Yi.c+12,ctr);
#endif
			else
				ctx->Yi.d[3] = ctr;
			while (len--) {
				u8 c = in[n];
				ctx->Xi.c[n] ^= c;
				out[n] = c^ctx->EKi.c[n];
				++n;
			}
		}

		ctx->mres = n;
		return 0;
	} while(0);
#endif
	for (i=0;i<len;++i) {
		u8 c;
		if (n==0) {
			(*block)(ctx->Yi.c,ctx->EKi.c,key);
			++ctr;
			if (is_endian.little)
#ifdef BSWAP4
				ctx->Yi.d[3] = BSWAP4(ctr);
#else
				PUTU32(ctx->Yi.c+12,ctr);
#endif
			else
				ctx->Yi.d[3] = ctr;
		}
		c = in[i];
		out[i] = c^ctx->EKi.c[n];
		ctx->Xi.c[n] ^= c;
		n = (n+1)%16;
		if (n==0)
			GCM_MUL(ctx,Xi);
	}

	ctx->mres = n;
	return 0;
}

int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,
		const unsigned char *in, unsigned char *out,
		size_t len, ctr128_f stream)
{
	const union { long one; char little; } is_endian = {1};
	unsigned int n, ctr;
	size_t i;
	u64   mlen = ctx->len.u[1];
	void *key  = ctx->key;
#ifdef GCM_FUNCREF_4BIT
	void (*gcm_gmult_p)(u64 Xi[2],const u128 Htable[16])	= ctx->gmult;
# ifdef GHASH
	void (*gcm_ghash_p)(u64 Xi[2],const u128 Htable[16],
				const u8 *inp,size_t len)	= ctx->ghash;
# endif
#endif

	mlen += len;
	if (mlen>((U64(1)<<36)-32) || (sizeof(len)==8 && mlen<len))
		return -1;
	ctx->len.u[1] = mlen;

	if (ctx->ares) {
		/* First call to encrypt finalizes GHASH(AAD) */
		GCM_MUL(ctx,Xi);
		ctx->ares = 0;
	}

	if (is_endian.little)
#ifdef BSWAP4
		ctr = BSWAP4(ctx->Yi.d[3]);
#else
		ctr = GETU32(ctx->Yi.c+12);
#endif
	else
		ctr = ctx->Yi.d[3];

	n = ctx->mres;
	if (n) {
		while (n && len) {
			ctx->Xi.c[n] ^= *(out++) = *(in++)^ctx->EKi.c[n];
			--len;
			n = (n+1)%16;
		}
		if (n==0) GCM_MUL(ctx,Xi);
		else {
			ctx->mres = n;
			return 0;
		}
	}
#if defined(GHASH) && !defined(OPENSSL_SMALL_FOOTPRINT)
	while (len>=GHASH_CHUNK) {
		(*stream)(in,out,GHASH_CHUNK/16,key,ctx->Yi.c);
		ctr += GHASH_CHUNK/16;
		if (is_endian.little)
#ifdef BSWAP4
			ctx->Yi.d[3] = BSWAP4(ctr);
#else
			PUTU32(ctx->Yi.c+12,ctr);
#endif
		else
			ctx->Yi.d[3] = ctr;
		GHASH(ctx,out,GHASH_CHUNK);
		out += GHASH_CHUNK;
		in  += GHASH_CHUNK;
		len -= GHASH_CHUNK;
	}
#endif
	if ((i = (len&(size_t)-16))) {
		size_t j=i/16;

		(*stream)(in,out,j,key,ctx->Yi.c);
		ctr += (unsigned int)j;
		if (is_endian.little)
#ifdef BSWAP4
			ctx->Yi.d[3] = BSWAP4(ctr);
#else
			PUTU32(ctx->Yi.c+12,ctr);
#endif
		else
			ctx->Yi.d[3] = ctr;
		in  += i;
		len -= i;
#if defined(GHASH)
		GHASH(ctx,out,i);
		out += i;
#else
		while (j--) {
			for (i=0;i<16;++i) ctx->Xi.c[i] ^= out[i];
			GCM_MUL(ctx,Xi);
			out += 16;
		}
#endif
	}
	if (len) {
		(*ctx->block)(ctx->Yi.c,ctx->EKi.c,key);
		++ctr;
		if (is_endian.little)
#ifdef BSWAP4
			ctx->Yi.d[3] = BSWAP4(ctr);
#else
			PUTU32(ctx->Yi.c+12,ctr);
#endif
		else
			ctx->Yi.d[3] = ctr;
		while (len--) {
			ctx->Xi.c[n] ^= out[n] = in[n]^ctx->EKi.c[n];
			++n;
		}
	}

	ctx->mres = n;
	return 0;
}

int CRYPTO_gcm128_decrypt_ctr32(GCM128_CONTEXT *ctx,
		const unsigned char *in, unsigned char *out,
		size_t len,ctr128_f stream)
{
	const union { long one; char little; } is_endian = {1};
	unsigned int n, ctr;
	size_t i;
	u64   mlen = ctx->len.u[1];
	void *key  = ctx->key;
#ifdef GCM_FUNCREF_4BIT
	void (*gcm_gmult_p)(u64 Xi[2],const u128 Htable[16])	= ctx->gmult;
# ifdef GHASH
	void (*gcm_ghash_p)(u64 Xi[2],const u128 Htable[16],
				const u8 *inp,size_t len)	= ctx->ghash;
# endif
#endif

	mlen += len;
	if (mlen>((U64(1)<<36)-32) || (sizeof(len)==8 && mlen<len))
		return -1;
	ctx->len.u[1] = mlen;

	if (ctx->ares) {
		/* First call to decrypt finalizes GHASH(AAD) */
		GCM_MUL(ctx,Xi);
		ctx->ares = 0;
	}

	if (is_endian.little)
#ifdef BSWAP4
		ctr = BSWAP4(ctx->Yi.d[3]);
#else
		ctr = GETU32(ctx->Yi.c+12);
#endif
	else
		ctr = ctx->Yi.d[3];

	n = ctx->mres;
	if (n) {
		while (n && len) {
			u8 c = *(in++);
			*(out++) = c^ctx->EKi.c[n];
			ctx->Xi.c[n] ^= c;
			--len;
			n = (n+1)%16;
		}
		if (n==0) GCM_MUL (ctx,Xi);
		else {
			ctx->mres = n;
			return 0;
		}
	}
#if defined(GHASH) && !defined(OPENSSL_SMALL_FOOTPRINT)
	while (len>=GHASH_CHUNK) {
		GHASH(ctx,in,GHASH_CHUNK);
		(*stream)(in,out,GHASH_CHUNK/16,key,ctx->Yi.c);
		ctr += GHASH_CHUNK/16;
		if (is_endian.little)
#ifdef BSWAP4
			ctx->Yi.d[3] = BSWAP4(ctr);
#else
			PUTU32(ctx->Yi.c+12,ctr);
#endif
		else
			ctx->Yi.d[3] = ctr;
		out += GHASH_CHUNK;
		in  += GHASH_CHUNK;
		len -= GHASH_CHUNK;
	}
#endif
	if ((i = (len&(size_t)-16))) {
		size_t j=i/16;

#if defined(GHASH)
		GHASH(ctx,in,i);
#else
		while (j--) {
			size_t k;
			for (k=0;k<16;++k) ctx->Xi.c[k] ^= in[k];
			GCM_MUL(ctx,Xi);
			in += 16;
		}
		j   = i/16;
		in -= i;
#endif
		(*stream)(in,out,j,key,ctx->Yi.c);
		ctr += (unsigned int)j;
		if (is_endian.little)
#ifdef BSWAP4
			ctx->Yi.d[3] = BSWAP4(ctr);
#else
			PUTU32(ctx->Yi.c+12,ctr);
#endif
		else
			ctx->Yi.d[3] = ctr;
		out += i;
		in  += i;
		len -= i;
	}
	if (len) {
		(*ctx->block)(ctx->Yi.c,ctx->EKi.c,key);
		++ctr;
		if (is_endian.little)
#ifdef BSWAP4
			ctx->Yi.d[3] = BSWAP4(ctr);
#else
			PUTU32(ctx->Yi.c+12,ctr);
#endif
		else
			ctx->Yi.d[3] = ctr;
		while (len--) {
			u8 c = in[n];
			ctx->Xi.c[n] ^= c;
			out[n] = c^ctx->EKi.c[n];
			++n;
		}
	}

	ctx->mres = n;
	return 0;
}

int CRYPTO_gcm128_finish(GCM128_CONTEXT *ctx,const unsigned char *tag,
			size_t len)
{
	const union { long one; char little; } is_endian = {1};
	u64 alen = ctx->len.u[0]<<3;
	u64 clen = ctx->len.u[1]<<3;
#ifdef GCM_FUNCREF_4BIT
	void (*gcm_gmult_p)(u64 Xi[2],const u128 Htable[16])	= ctx->gmult;
#endif

	if (ctx->mres || ctx->ares)
		GCM_MUL(ctx,Xi);

	if (is_endian.little) {
#ifdef BSWAP8
		alen = BSWAP8(alen);
		clen = BSWAP8(clen);
#else
		u8 *p = ctx->len.c;

		ctx->len.u[0] = alen;
		ctx->len.u[1] = clen;

		alen = (u64)GETU32(p)  <<32|GETU32(p+4);
		clen = (u64)GETU32(p+8)<<32|GETU32(p+12);
#endif
	}

	ctx->Xi.u[0] ^= alen;
	ctx->Xi.u[1] ^= clen;
	GCM_MUL(ctx,Xi);

	ctx->Xi.u[0] ^= ctx->EK0.u[0];
	ctx->Xi.u[1] ^= ctx->EK0.u[1];

	if (tag && len<=sizeof(ctx->Xi))
		return memcmp(ctx->Xi.c,tag,len);
	else
		return -1;
}

void CRYPTO_gcm128_tag(GCM128_CONTEXT *ctx, unsigned char *tag, size_t len)
{
	CRYPTO_gcm128_finish(ctx, NULL, 0);
	memcpy(tag, ctx->Xi.c, len<=sizeof(ctx->Xi.c)?len:sizeof(ctx->Xi.c));
}

GCM128_CONTEXT *CRYPTO_gcm128_new(void *key, block128_f block)
{
	GCM128_CONTEXT *ret;

	if ((ret = (GCM128_CONTEXT *)OPENSSL_malloc(sizeof(GCM128_CONTEXT))))
		CRYPTO_gcm128_init(ret,key,block);

	return ret;
}

void CRYPTO_gcm128_release(GCM128_CONTEXT *ctx)
{
	if (ctx) {
		OPENSSL_cleanse(ctx,sizeof(*ctx));
		OPENSSL_free(ctx);
	}
}

#if defined(SELFTEST)
#include <stdio.h>
#include <openssl/aes.h>

/* Test Case 1 */
static const u8	K1[16],
		*P1=NULL,
		*A1=NULL,
		IV1[12],
		*C1=NULL,
		T1[]=  {0x58,0xe2,0xfc,0xce,0xfa,0x7e,0x30,0x61,0x36,0x7f,0x1d,0x57,0xa4,0xe7,0x45,0x5a};

/* Test Case 2 */
#define K2 K1
#define A2 A1
#define IV2 IV1
static const u8	P2[16],
		C2[]=  {0x03,0x88,0xda,0xce,0x60,0xb6,0xa3,0x92,0xf3,0x28,0xc2,0xb9,0x71,0xb2,0xfe,0x78},
		T2[]=  {0xab,0x6e,0x47,0xd4,0x2c,0xec,0x13,0xbd,0xf5,0x3a,0x67,0xb2,0x12,0x57,0xbd,0xdf};

/* Test Case 3 */
#define A3 A2
static const u8	K3[]=  {0xfe,0xff,0xe9,0x92,0x86,0x65,0x73,0x1c,0x6d,0x6a,0x8f,0x94,0x67,0x30,0x83,0x08},
		P3[]=  {0xd9,0x31,0x32,0x25,0xf8,0x84,0x06,0xe5,0xa5,0x59,0x09,0xc5,0xaf,0xf5,0x26,0x9a,
			0x86,0xa7,0xa9,0x53,0x15,0x34,0xf7,0xda,0x2e,0x4c,0x30,0x3d,0x8a,0x31,0x8a,0x72,
			0x1c,0x3c,0x0c,0x95,0x95,0x68,0x09,0x53,0x2f,0xcf,0x0e,0x24,0x49,0xa6,0xb5,0x25,
			0xb1,0x6a,0xed,0xf5,0xaa,0x0d,0xe6,0x57,0xba,0x63,0x7b,0x39,0x1a,0xaf,0xd2,0x55},
		IV3[]= {0xca,0xfe,0xba,0xbe,0xfa,0xce,0xdb,0xad,0xde,0xca,0xf8,0x88},
		C3[]=  {0x42,0x83,0x1e,0xc2,0x21,0x77,0x74,0x24,0x4b,0x72,0x21,0xb7,0x84,0xd0,0xd4,0x9c,
			0xe3,0xaa,0x21,0x2f,0x2c,0x02,0xa4,0xe0,0x35,0xc1,0x7e,0x23,0x29,0xac,0xa1,0x2e,
			0x21,0xd5,0x14,0xb2,0x54,0x66,0x93,0x1c,0x7d,0x8f,0x6a,0x5a,0xac,0x84,0xaa,0x05,
			0x1b,0xa3,0x0b,0x39,0x6a,0x0a,0xac,0x97,0x3d,0x58,0xe0,0x91,0x47,0x3f,0x59,0x85},
		T3[]=  {0x4d,0x5c,0x2a,0xf3,0x27,0xcd,0x64,0xa6,0x2c,0xf3,0x5a,0xbd,0x2b,0xa6,0xfa,0xb4};

/* Test Case 4 */
#define K4 K3
#define IV4 IV3
static const u8	P4[]=  {0xd9,0x31,0x32,0x25,0xf8,0x84,0x06,0xe5,0xa5,0x59,0x09,0xc5,0xaf,0xf5,0x26,0x9a,
			0x86,0xa7,0xa9,0x53,0x15,0x34,0xf7,0xda,0x2e,0x4c,0x30,0x3d,0x8a,0x31,0x8a,0x72,
			0x1c,0x3c,0x0c,0x95,0x95,0x68,0x09,0x53,0x2f,0xcf,0x0e,0x24,0x49,0xa6,0xb5,0x25,
			0xb1,0x6a,0xed,0xf5,0xaa,0x0d,0xe6,0x57,0xba,0x63,0x7b,0x39},
		A4[]=  {0xfe,0xed,0xfa,0xce,0xde,0xad,0xbe,0xef,0xfe,0xed,0xfa,0xce,0xde,0xad,0xbe,0xef,
			0xab,0xad,0xda,0xd2},
		C4[]=  {0x42,0x83,0x1e,0xc2,0x21,0x77,0x74,0x24,0x4b,0x72,0x21,0xb7,0x84,0xd0,0xd4,0x9c,
			0xe3,0xaa,0x21,0x2f,0x2c,0x02,0xa4,0xe0,0x35,0xc1,0x7e,0x23,0x29,0xac,0xa1,0x2e,
			0x21,0xd5,0x14,0xb2,0x54,0x66,0x93,0x1c,0x7d,0x8f,0x6a,0x5a,0xac,0x84,0xaa,0x05,
			0x1b,0xa3,0x0b,0x39,0x6a,0x0a,0xac,0x97,0x3d,0x58,0xe0,0x91},
		T4[]=  {0x5b,0xc9,0x4f,0xbc,0x32,0x21,0xa5,0xdb,0x94,0xfa,0xe9,0x5a,0xe7,0x12,0x1a,0x47};

/* Test Case 5 */
#define K5 K4
#define P5 P4
#define A5 A4
static const u8	IV5[]= {0xca,0xfe,0xba,0xbe,0xfa,0xce,0xdb,0xad},
		C5[]=  {0x61,0x35,0x3b,0x4c,0x28,0x06,0x93,0x4a,0x77,0x7f,0xf5,0x1f,0xa2,0x2a,0x47,0x55,
			0x69,0x9b,0x2a,0x71,0x4f,0xcd,0xc6,0xf8,0x37,0x66,0xe5,0xf9,0x7b,0x6c,0x74,0x23,
			0x73,0x80,0x69,0x00,0xe4,0x9f,0x24,0xb2,0x2b,0x09,0x75,0x44,0xd4,0x89,0x6b,0x42,
			0x49,0x89,0xb5,0xe1,0xeb,0xac,0x0f,0x07,0xc2,0x3f,0x45,0x98},
		T5[]=  {0x36,0x12,0xd2,0xe7,0x9e,0x3b,0x07,0x85,0x56,0x1b,0xe1,0x4a,0xac,0xa2,0xfc,0xcb};

/* Test Case 6 */
#define K6 K5
#define P6 P5
#define A6 A5
static const u8	IV6[]= {0x93,0x13,0x22,0x5d,0xf8,0x84,0x06,0xe5,0x55,0x90,0x9c,0x5a,0xff,0x52,0x69,0xaa,
			0x6a,0x7a,0x95,0x38,0x53,0x4f,0x7d,0xa1,0xe4,0xc3,0x03,0xd2,0xa3,0x18,0xa7,0x28,
			0xc3,0xc0,0xc9,0x51,0x56,0x80,0x95,0x39,0xfc,0xf0,0xe2,0x42,0x9a,0x6b,0x52,0x54,
			0x16,0xae,0xdb,0xf5,0xa0,0xde,0x6a,0x57,0xa6,0x37,0xb3,0x9b},
		C6[]=  {0x8c,0xe2,0x49,0x98,0x62,0x56,0x15,0xb6,0x03,0xa0,0x33,0xac,0xa1,0x3f,0xb8,0x94,
			0xbe,0x91,0x12,0xa5,0xc3,0xa2,0x11,0xa8,0xba,0x26,0x2a,0x3c,0xca,0x7e,0x2c,0xa7,
			0x01,0xe4,0xa9,0xa4,0xfb,0xa4,0x3c,0x90,0xcc,0xdc,0xb2,0x81,0xd4,0x8c,0x7c,0x6f,
			0xd6,0x28,0x75,0xd2,0xac,0xa4,0x17,0x03,0x4c,0x34,0xae,0xe5},
		T6[]=  {0x61,0x9c,0xc5,0xae,0xff,0xfe,0x0b,0xfa,0x46,0x2a,0xf4,0x3c,0x16,0x99,0xd0,0x50};

/* Test Case 7 */
static const u8 K7[24],
		*P7=NULL,
		*A7=NULL,
		IV7[12],
		*C7=NULL,
		T7[]=  {0xcd,0x33,0xb2,0x8a,0xc7,0x73,0xf7,0x4b,0xa0,0x0e,0xd1,0xf3,0x12,0x57,0x24,0x35};

/* Test Case 8 */
#define K8 K7
#define IV8 IV7
#define A8 A7
static const u8	P8[16],
		C8[]=  {0x98,0xe7,0x24,0x7c,0x07,0xf0,0xfe,0x41,0x1c,0x26,0x7e,0x43,0x84,0xb0,0xf6,0x00},
		T8[]=  {0x2f,0xf5,0x8d,0x80,0x03,0x39,0x27,0xab,0x8e,0xf4,0xd4,0x58,0x75,0x14,0xf0,0xfb};

/* Test Case 9 */
#define A9 A8
static const u8	K9[]=  {0xfe,0xff,0xe9,0x92,0x86,0x65,0x73,0x1c,0x6d,0x6a,0x8f,0x94,0x67,0x30,0x83,0x08,
			0xfe,0xff,0xe9,0x92,0x86,0x65,0x73,0x1c},
		P9[]=  {0xd9,0x31,0x32,0x25,0xf8,0x84,0x06,0xe5,0xa5,0x59,0x09,0xc5,0xaf,0xf5,0x26,0x9a,
			0x86,0xa7,0xa9,0x53,0x15,0x34,0xf7,0xda,0x2e,0x4c,0x30,0x3d,0x8a,0x31,0x8a,0x72,
			0x1c,0x3c,0x0c,0x95,0x95,0x68,0x09,0x53,0x2f,0xcf,0x0e,0x24,0x49,0xa6,0xb5,0x25,
			0xb1,0x6a,0xed,0xf5,0xaa,0x0d,0xe6,0x57,0xba,0x63,0x7b,0x39,0x1a,0xaf,0xd2,0x55},
		IV9[]= {0xca,0xfe,0xba,0xbe,0xfa,0xce,0xdb,0xad,0xde,0xca,0xf8,0x88},
		C9[]=  {0x39,0x80,0xca,0x0b,0x3c,0x00,0xe8,0x41,0xeb,0x06,0xfa,0xc4,0x87,0x2a,0x27,0x57,
			0x85,0x9e,0x1c,0xea,0xa6,0xef,0xd9,0x84,0x62,0x85,0x93,0xb4,0x0c,0xa1,0xe1,0x9c,
			0x7d,0x77,0x3d,0x00,0xc1,0x44,0xc5,0x25,0xac,0x61,0x9d,0x18,0xc8,0x4a,0x3f,0x47,
			0x18,0xe2,0x44,0x8b,0x2f,0xe3,0x24,0xd9,0xcc,0xda,0x27,0x10,0xac,0xad,0xe2,0x56},
		T9[]=  {0x99,0x24,0xa7,0xc8,0x58,0x73,0x36,0xbf,0xb1,0x18,0x02,0x4d,0xb8,0x67,0x4a,0x14};

/* Test Case 10 */
#define K10 K9
#define IV10 IV9
static const u8	P10[]= {0xd9,0x31,0x32,0x25,0xf8,0x84,0x06,0xe5,0xa5,0x59,0x09,0xc5,0xaf,0xf5,0x26,0x9a,
			0x86,0xa7,0xa9,0x53,0x15,0x34,0xf7,0xda,0x2e,0x4c,0x30,0x3d,0x8a,0x31,0x8a,0x72,
			0x1c,0x3c,0x0c,0x95,0x95,0x68,0x09,0x53,0x2f,0xcf,0x0e,0x24,0x49,0xa6,0xb5,0x25,
			0xb1,0x6a,0xed,0xf5,0xaa,0x0d,0xe6,0x57,0xba,0x63,0x7b,0x39},
		A10[]= {0xfe,0xed,0xfa,0xce,0xde,0xad,0xbe,0xef,0xfe,0xed,0xfa,0xce,0xde,0xad,0xbe,0xef,
			0xab,0xad,0xda,0xd2},
		C10[]= {0x39,0x80,0xca,0x0b,0x3c,0x00,0xe8,0x41,0xeb,0x06,0xfa,0xc4,0x87,0x2a,0x27,0x57,
			0x85,0x9e,0x1c,0xea,0xa6,0xef,0xd9,0x84,0x62,0x85,0x93,0xb4,0x0c,0xa1,0xe1,0x9c,
			0x7d,0x77,0x3d,0x00,0xc1,0x44,0xc5,0x25,0xac,0x61,0x9d,0x18,0xc8,0x4a,0x3f,0x47,
			0x18,0xe2,0x44,0x8b,0x2f,0xe3,0x24,0xd9,0xcc,0xda,0x27,0x10},
		T10[]= {0x25,0x19,0x49,0x8e,0x80,0xf1,0x47,0x8f,0x37,0xba,0x55,0xbd,0x6d,0x27,0x61,0x8c};

/* Test Case 11 */
#define K11 K10
#define P11 P10
#define A11 A10
static const u8	IV11[]={0xca,0xfe,0xba,0xbe,0xfa,0xce,0xdb,0xad},
		C11[]= {0x0f,0x10,0xf5,0x99,0xae,0x14,0xa1,0x54,0xed,0x24,0xb3,0x6e,0x25,0x32,0x4d,0xb8,
			0xc5,0x66,0x63,0x2e,0xf2,0xbb,0xb3,0x4f,0x83,0x47,0x28,0x0f,0xc4,0x50,0x70,0x57,
			0xfd,0xdc,0x29,0xdf,0x9a,0x47,0x1f,0x75,0xc6,0x65,0x41,0xd4,0xd4,0xda,0xd1,0xc9,
			0xe9,0x3a,0x19,0xa5,0x8e,0x8b,0x47,0x3f,0xa0,0xf0,0x62,0xf7},
		T11[]= {0x65,0xdc,0xc5,0x7f,0xcf,0x62,0x3a,0x24,0x09,0x4f,0xcc,0xa4,0x0d,0x35,0x33,0xf8};

/* Test Case 12 */
#define K12 K11
#define P12 P11
#define A12 A11
static const u8	IV12[]={0x93,0x13,0x22,0x5d,0xf8,0x84,0x06,0xe5,0x55,0x90,0x9c,0x5a,0xff,0x52,0x69,0xaa,
			0x6a,0x7a,0x95,0x38,0x53,0x4f,0x7d,0xa1,0xe4,0xc3,0x03,0xd2,0xa3,0x18,0xa7,0x28,
			0xc3,0xc0,0xc9,0x51,0x56,0x80,0x95,0x39,0xfc,0xf0,0xe2,0x42,0x9a,0x6b,0x52,0x54,
			0x16,0xae,0xdb,0xf5,0xa0,0xde,0x6a,0x57,0xa6,0x37,0xb3,0x9b},
		C12[]= {0xd2,0x7e,0x88,0x68,0x1c,0xe3,0x24,0x3c,0x48,0x30,0x16,0x5a,0x8f,0xdc,0xf9,0xff,
			0x1d,0xe9,0xa1,0xd8,0xe6,0xb4,0x47,0xef,0x6e,0xf7,0xb7,0x98,0x28,0x66,0x6e,0x45,
			0x81,0xe7,0x90,0x12,0xaf,0x34,0xdd,0xd9,0xe2,0xf0,0x37,0x58,0x9b,0x29,0x2d,0xb3,
			0xe6,0x7c,0x03,0x67,0x45,0xfa,0x22,0xe7,0xe9,0xb7,0x37,0x3b},
		T12[]= {0xdc,0xf5,0x66,0xff,0x29,0x1c,0x25,0xbb,0xb8,0x56,0x8f,0xc3,0xd3,0x76,0xa6,0xd9};

/* Test Case 13 */
static const u8	K13[32],
		*P13=NULL,
		*A13=NULL,
		IV13[12],
		*C13=NULL,
		T13[]={0x53,0x0f,0x8a,0xfb,0xc7,0x45,0x36,0xb9,0xa9,0x63,0xb4,0xf1,0xc4,0xcb,0x73,0x8b};

/* Test Case 14 */
#define K14 K13
#define A14 A13
static const u8	P14[16],
		IV14[12],
		C14[]= {0xce,0xa7,0x40,0x3d,0x4d,0x60,0x6b,0x6e,0x07,0x4e,0xc5,0xd3,0xba,0xf3,0x9d,0x18},
		T14[]= {0xd0,0xd1,0xc8,0xa7,0x99,0x99,0x6b,0xf0,0x26,0x5b,0x98,0xb5,0xd4,0x8a,0xb9,0x19};

/* Test Case 15 */
#define A15 A14
static const u8	K15[]= {0xfe,0xff,0xe9,0x92,0x86,0x65,0x73,0x1c,0x6d,0x6a,0x8f,0x94,0x67,0x30,0x83,0x08,
			0xfe,0xff,0xe9,0x92,0x86,0x65,0x73,0x1c,0x6d,0x6a,0x8f,0x94,0x67,0x30,0x83,0x08},
		P15[]= {0xd9,0x31,0x32,0x25,0xf8,0x84,0x06,0xe5,0xa5,0x59,0x09,0xc5,0xaf,0xf5,0x26,0x9a,
			0x86,0xa7,0xa9,0x53,0x15,0x34,0xf7,0xda,0x2e,0x4c,0x30,0x3d,0x8a,0x31,0x8a,0x72,
			0x1c,0x3c,0x0c,0x95,0x95,0x68,0x09,0x53,0x2f,0xcf,0x0e,0x24,0x49,0xa6,0xb5,0x25,
			0xb1,0x6a,0xed,0xf5,0xaa,0x0d,0xe6,0x57,0xba,0x63,0x7b,0x39,0x1a,0xaf,0xd2,0x55},
		IV15[]={0xca,0xfe,0xba,0xbe,0xfa,0xce,0xdb,0xad,0xde,0xca,0xf8,0x88},
		C15[]= {0x52,0x2d,0xc1,0xf0,0x99,0x56,0x7d,0x07,0xf4,0x7f,0x37,0xa3,0x2a,0x84,0x42,0x7d,
			0x64,0x3a,0x8c,0xdc,0xbf,0xe5,0xc0,0xc9,0x75,0x98,0xa2,0xbd,0x25,0x55,0xd1,0xaa,
			0x8c,0xb0,0x8e,0x48,0x59,0x0d,0xbb,0x3d,0xa7,0xb0,0x8b,0x10,0x56,0x82,0x88,0x38,
			0xc5,0xf6,0x1e,0x63,0x93,0xba,0x7a,0x0a,0xbc,0xc9,0xf6,0x62,0x89,0x80,0x15,0xad},
		T15[]= {0xb0,0x94,0xda,0xc5,0xd9,0x34,0x71,0xbd,0xec,0x1a,0x50,0x22,0x70,0xe3,0xcc,0x6c};

/* Test Case 16 */
#define K16 K15
#define IV16 IV15
static const u8	P16[]= {0xd9,0x31,0x32,0x25,0xf8,0x84,0x06,0xe5,0xa5,0x59,0x09,0xc5,0xaf,0xf5,0x26,0x9a,
			0x86,0xa7,0xa9,0x53,0x15,0x34,0xf7,0xda,0x2e,0x4c,0x30,0x3d,0x8a,0x31,0x8a,0x72,
			0x1c,0x3c,0x0c,0x95,0x95,0x68,0x09,0x53,0x2f,0xcf,0x0e,0x24,0x49,0xa6,0xb5,0x25,
			0xb1,0x6a,0xed,0xf5,0xaa,0x0d,0xe6,0x57,0xba,0x63,0x7b,0x39},
		A16[]= {0xfe,0xed,0xfa,0xce,0xde,0xad,0xbe,0xef,0xfe,0xed,0xfa,0xce,0xde,0xad,0xbe,0xef,
			0xab,0xad,0xda,0xd2},
		C16[]= {0x52,0x2d,0xc1,0xf0,0x99,0x56,0x7d,0x07,0xf4,0x7f,0x37,0xa3,0x2a,0x84,0x42,0x7d,
			0x64,0x3a,0x8c,0xdc,0xbf,0xe5,0xc0,0xc9,0x75,0x98,0xa2,0xbd,0x25,0x55,0xd1,0xaa,
			0x8c,0xb0,0x8e,0x48,0x59,0x0d,0xbb,0x3d,0xa7,0xb0,0x8b,0x10,0x56,0x82,0x88,0x38,
			0xc5,0xf6,0x1e,0x63,0x93,0xba,0x7a,0x0a,0xbc,0xc9,0xf6,0x62},
		T16[]= {0x76,0xfc,0x6e,0xce,0x0f,0x4e,0x17,0x68,0xcd,0xdf,0x88,0x53,0xbb,0x2d,0x55,0x1b};

/* Test Case 17 */
#define K17 K16
#define P17 P16
#define A17 A16
static const u8	IV17[]={0xca,0xfe,0xba,0xbe,0xfa,0xce,0xdb,0xad},
		C17[]= {0xc3,0x76,0x2d,0xf1,0xca,0x78,0x7d,0x32,0xae,0x47,0xc1,0x3b,0xf1,0x98,0x44,0xcb,
			0xaf,0x1a,0xe1,0x4d,0x0b,0x97,0x6a,0xfa,0xc5,0x2f,0xf7,0xd7,0x9b,0xba,0x9d,0xe0,
			0xfe,0xb5,0x82,0xd3,0x39,0x34,0xa4,0xf0,0x95,0x4c,0xc2,0x36,0x3b,0xc7,0x3f,0x78,
			0x62,0xac,0x43,0x0e,0x64,0xab,0xe4,0x99,0xf4,0x7c,0x9b,0x1f},
		T17[]= {0x3a,0x33,0x7d,0xbf,0x46,0xa7,0x92,0xc4,0x5e,0x45,0x49,0x13,0xfe,0x2e,0xa8,0xf2};

/* Test Case 18 */
#define K18 K17
#define P18 P17
#define A18 A17
static const u8	IV18[]={0x93,0x13,0x22,0x5d,0xf8,0x84,0x06,0xe5,0x55,0x90,0x9c,0x5a,0xff,0x52,0x69,0xaa,
			0x6a,0x7a,0x95,0x38,0x53,0x4f,0x7d,0xa1,0xe4,0xc3,0x03,0xd2,0xa3,0x18,0xa7,0x28,
			0xc3,0xc0,0xc9,0x51,0x56,0x80,0x95,0x39,0xfc,0xf0,0xe2,0x42,0x9a,0x6b,0x52,0x54,
			0x16,0xae,0xdb,0xf5,0xa0,0xde,0x6a,0x57,0xa6,0x37,0xb3,0x9b},
		C18[]= {0x5a,0x8d,0xef,0x2f,0x0c,0x9e,0x53,0xf1,0xf7,0x5d,0x78,0x53,0x65,0x9e,0x2a,0x20,
			0xee,0xb2,0xb2,0x2a,0xaf,0xde,0x64,0x19,0xa0,0x58,0xab,0x4f,0x6f,0x74,0x6b,0xf4,
			0x0f,0xc0,0xc3,0xb7,0x80,0xf2,0x44,0x45,0x2d,0xa3,0xeb,0xf1,0xc5,0xd8,0x2c,0xde,
			0xa2,0x41,0x89,0x97,0x20,0x0e,0xf8,0x2e,0x44,0xae,0x7e,0x3f},
		T18[]= {0xa4,0x4a,0x82,0x66,0xee,0x1c,0x8e,0xb0,0xc8,0xb5,0xd4,0xcf,0x5a,0xe9,0xf1,0x9a};

/* Test Case 19 */
#define K19 K1
#define P19 P1
#define IV19 IV1
#define C19 C1
static const u8 A19[]= {0xd9,0x31,0x32,0x25,0xf8,0x84,0x06,0xe5,0xa5,0x59,0x09,0xc5,0xaf,0xf5,0x26,0x9a,
			0x86,0xa7,0xa9,0x53,0x15,0x34,0xf7,0xda,0x2e,0x4c,0x30,0x3d,0x8a,0x31,0x8a,0x72,
			0x1c,0x3c,0x0c,0x95,0x95,0x68,0x09,0x53,0x2f,0xcf,0x0e,0x24,0x49,0xa6,0xb5,0x25,
			0xb1,0x6a,0xed,0xf5,0xaa,0x0d,0xe6,0x57,0xba,0x63,0x7b,0x39,0x1a,0xaf,0xd2,0x55,
			0x52,0x2d,0xc1,0xf0,0x99,0x56,0x7d,0x07,0xf4,0x7f,0x37,0xa3,0x2a,0x84,0x42,0x7d,
			0x64,0x3a,0x8c,0xdc,0xbf,0xe5,0xc0,0xc9,0x75,0x98,0xa2,0xbd,0x25,0x55,0xd1,0xaa,
			0x8c,0xb0,0x8e,0x48,0x59,0x0d,0xbb,0x3d,0xa7,0xb0,0x8b,0x10,0x56,0x82,0x88,0x38,
			0xc5,0xf6,0x1e,0x63,0x93,0xba,0x7a,0x0a,0xbc,0xc9,0xf6,0x62,0x89,0x80,0x15,0xad},
		T19[]= {0x5f,0xea,0x79,0x3a,0x2d,0x6f,0x97,0x4d,0x37,0xe6,0x8e,0x0c,0xb8,0xff,0x94,0x92};

/* Test Case 20 */
#define K20 K1
#define A20 A1
static const u8 IV20[64]={0xff,0xff,0xff,0xff},	/* this results in 0xff in counter LSB */
		P20[288],
		C20[]= {0x56,0xb3,0x37,0x3c,0xa9,0xef,0x6e,0x4a,0x2b,0x64,0xfe,0x1e,0x9a,0x17,0xb6,0x14,
			0x25,0xf1,0x0d,0x47,0xa7,0x5a,0x5f,0xce,0x13,0xef,0xc6,0xbc,0x78,0x4a,0xf2,0x4f,
			0x41,0x41,0xbd,0xd4,0x8c,0xf7,0xc7,0x70,0x88,0x7a,0xfd,0x57,0x3c,0xca,0x54,0x18,
			0xa9,0xae,0xff,0xcd,0x7c,0x5c,0xed,0xdf,0xc6,0xa7,0x83,0x97,0xb9,0xa8,0x5b,0x49,
			0x9d,0xa5,0x58,0x25,0x72,0x67,0xca,0xab,0x2a,0xd0,0xb2,0x3c,0xa4,0x76,0xa5,0x3c,
			0xb1,0x7f,0xb4,0x1c,0x4b,0x8b,0x47,0x5c,0xb4,0xf3,0xf7,0x16,0x50,0x94,0xc2,0x29,
			0xc9,0xe8,0xc4,0xdc,0x0a,0x2a,0x5f,0xf1,0x90,0x3e,0x50,0x15,0x11,0x22,0x13,0x76,
			0xa1,0xcd,0xb8,0x36,0x4c,0x50,0x61,0xa2,0x0c,0xae,0x74,0xbc,0x4a,0xcd,0x76,0xce,
			0xb0,0xab,0xc9,0xfd,0x32,0x17,0xef,0x9f,0x8c,0x90,0xbe,0x40,0x2d,0xdf,0x6d,0x86,
			0x97,0xf4,0xf8,0x80,0xdf,0xf1,0x5b,0xfb,0x7a,0x6b,0x28,0x24,0x1e,0xc8,0xfe,0x18,
			0x3c,0x2d,0x59,0xe3,0xf9,0xdf,0xff,0x65,0x3c,0x71,0x26,0xf0,0xac,0xb9,0xe6,0x42,
			0x11,0xf4,0x2b,0xae,0x12,0xaf,0x46,0x2b,0x10,0x70,0xbe,0xf1,0xab,0x5e,0x36,0x06,
			0x87,0x2c,0xa1,0x0d,0xee,0x15,0xb3,0x24,0x9b,0x1a,0x1b,0x95,0x8f,0x23,0x13,0x4c,
			0x4b,0xcc,0xb7,0xd0,0x32,0x00,0xbc,0xe4,0x20,0xa2,0xf8,0xeb,0x66,0xdc,0xf3,0x64,
			0x4d,0x14,0x23,0xc1,0xb5,0x69,0x90,0x03,0xc1,0x3e,0xce,0xf4,0xbf,0x38,0xa3,0xb6,
			0x0e,0xed,0xc3,0x40,0x33,0xba,0xc1,0x90,0x27,0x83,0xdc,0x6d,0x89,0xe2,0xe7,0x74,
			0x18,0x8a,0x43,0x9c,0x7e,0xbc,0xc0,0x67,0x2d,0xbd,0xa4,0xdd,0xcf,0xb2,0x79,0x46,
			0x13,0xb0,0xbe,0x41,0x31,0x5e,0xf7,0x78,0x70,0x8a,0x70,0xee,0x7d,0x75,0x16,0x5c},
		T20[]= {0x8b,0x30,0x7f,0x6b,0x33,0x28,0x6d,0x0a,0xb0,0x26,0xa9,0xed,0x3f,0xe1,0xe8,0x5f};

#define TEST_CASE(n)	do {					\
	u8 out[sizeof(P##n)];					\
	AES_set_encrypt_key(K##n,sizeof(K##n)*8,&key);		\
	CRYPTO_gcm128_init(&ctx,&key,(block128_f)AES_encrypt);	\
	CRYPTO_gcm128_setiv(&ctx,IV##n,sizeof(IV##n));		\
	memset(out,0,sizeof(out));				\
	if (A##n) CRYPTO_gcm128_aad(&ctx,A##n,sizeof(A##n));	\
	if (P##n) CRYPTO_gcm128_encrypt(&ctx,P##n,out,sizeof(out));	\
	if (CRYPTO_gcm128_finish(&ctx,T##n,16) ||		\
	    (C##n && memcmp(out,C##n,sizeof(out))))		\
		ret++, printf ("encrypt test#%d failed.\n",n);	\
	CRYPTO_gcm128_setiv(&ctx,IV##n,sizeof(IV##n));		\
	memset(out,0,sizeof(out));				\
	if (A##n) CRYPTO_gcm128_aad(&ctx,A##n,sizeof(A##n));	\
	if (C##n) CRYPTO_gcm128_decrypt(&ctx,C##n,out,sizeof(out));	\
	if (CRYPTO_gcm128_finish(&ctx,T##n,16) ||		\
	    (P##n && memcmp(out,P##n,sizeof(out))))		\
		ret++, printf ("decrypt test#%d failed.\n",n);	\
	} while(0)

int main()
{
	GCM128_CONTEXT ctx;
	AES_KEY key;
	int ret=0;

	TEST_CASE(1);
	TEST_CASE(2);
	TEST_CASE(3);
	TEST_CASE(4);
	TEST_CASE(5);
	TEST_CASE(6);
	TEST_CASE(7);
	TEST_CASE(8);
	TEST_CASE(9);
	TEST_CASE(10);
	TEST_CASE(11);
	TEST_CASE(12);
	TEST_CASE(13);
	TEST_CASE(14);
	TEST_CASE(15);
	TEST_CASE(16);
	TEST_CASE(17);
	TEST_CASE(18);
	TEST_CASE(19);
	TEST_CASE(20);

#ifdef OPENSSL_CPUID_OBJ
	{
	size_t start,stop,gcm_t,ctr_t,OPENSSL_rdtsc();
	union { u64 u; u8 c[1024]; } buf;
	int i;

	AES_set_encrypt_key(K1,sizeof(K1)*8,&key);
	CRYPTO_gcm128_init(&ctx,&key,(block128_f)AES_encrypt);
	CRYPTO_gcm128_setiv(&ctx,IV1,sizeof(IV1));

	CRYPTO_gcm128_encrypt(&ctx,buf.c,buf.c,sizeof(buf));
	start = OPENSSL_rdtsc();
	CRYPTO_gcm128_encrypt(&ctx,buf.c,buf.c,sizeof(buf));
	gcm_t = OPENSSL_rdtsc() - start;

	CRYPTO_ctr128_encrypt(buf.c,buf.c,sizeof(buf),
			&key,ctx.Yi.c,ctx.EKi.c,&ctx.mres,
			(block128_f)AES_encrypt);
	start = OPENSSL_rdtsc();
	CRYPTO_ctr128_encrypt(buf.c,buf.c,sizeof(buf),
			&key,ctx.Yi.c,ctx.EKi.c,&ctx.mres,
			(block128_f)AES_encrypt);
	ctr_t = OPENSSL_rdtsc() - start;

	printf("%.2f-%.2f=%.2f\n",
			gcm_t/(double)sizeof(buf),
			ctr_t/(double)sizeof(buf),
			(gcm_t-ctr_t)/(double)sizeof(buf));
#ifdef GHASH
	{
	void (*gcm_ghash_p)(u64 Xi[2],const u128 Htable[16],
				const u8 *inp,size_t len)	= ctx.ghash;

	GHASH((&ctx),buf.c,sizeof(buf));
	start = OPENSSL_rdtsc();
	for (i=0;i<100;++i) GHASH((&ctx),buf.c,sizeof(buf));
	gcm_t = OPENSSL_rdtsc() - start;
	printf("%.2f\n",gcm_t/(double)sizeof(buf)/(double)i);
	}
#endif
	}
#endif

	return ret;
}
#endif