in src/gcm.c [283:303]
void GCM_finish(gcm *g,char *tag)
{
/* Finish off GHASH and extract tag (MAC) */
int i;
GCM_wrap(g);
/* extract tag */
if (tag!=NULL)
{
AES_ecb_encrypt(&(g->a),g->Y_0); /* E(K,Y0) */
for (i=0; i<16; i++) g->Y_0[i]^=g->stateX[i];
for (i=0; i<16; i++)
{
tag[i]=g->Y_0[i];
g->Y_0[i]=g->stateX[i]=0;
}
}
g->status=GCM_FINISHED;
AES_end(&(g->a));
}