in src/gcm.c [157:192]
void GCM_init(gcm* g,int nk,char *key,int niv,const char *iv)
{
/* iv size niv is usually 12 bytes (96 bits). AES key size nk can be 16,24 or 32 bytes */
uchar H[16];
for (int i=0; i<16; i++)
{
H[i]=0;
g->stateX[i]=0;
}
AES_init(&(g->a),ECB,nk,key,iv);
AES_ecb_encrypt(&(g->a),H); /* E(K,0) */
precompute(g,H);
g->lenA[0]=g->lenC[0]=g->lenA[1]=g->lenC[1]=0;
if (niv==12)
{
for (int i=0; i<12; i++) g->a.f[i]=iv[i];
unpack((unsign32)1,(uchar *)&(g->a.f[12])); /* initialise IV */
for (int i=0; i<16; i++) g->Y_0[i]=g->a.f[i];
}
else
{
g->status=GCM_ACCEPTING_CIPHER;
GCM_ghash(g,iv,niv); /* GHASH(H,0,IV) */
GCM_wrap(g);
for (int i=0; i<16; i++)
{
g->a.f[i]=g->stateX[i];
g->Y_0[i]=g->a.f[i];
g->stateX[i]=0;
}
g->lenA[0]=g->lenC[0]=g->lenA[1]=g->lenC[1]=0;
}
g->status=GCM_ACCEPTING_HEADER;
}