def ghash

bend-collections-laws-crypto@1.0.0.0 · src/crypto/aes/gcm.bend:101

import Base

101# GHASH_H over the bytes, a last partial block padded with zero bytes.
102def ghash(+h: Block, +xs: List<&2, U32>, y: Block) -> Block:
103  match xs:
104    case x0 <> x1 <> x2 <> x3 <> x4 <> x5 <> x6 <> x7 <> x8 <> x9 <> x10 <> x11 <> x12 <> x13 <> x14 <> x15 <> rest:
105      ghash(h, rest, absorb(h, y, [x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15]))
106    case Nil{}:
107      y
108    case _:
109      absorb(h, y, List.append(&2, U32, xs, zeros(Nat.sub(16n, List.length(&2, U32, xs)))))