aes_gcm_ghash
aes_gcm_ghash(H, aad, aad_len, crypt, plain_len, S);
aes_gcm_ghash(H, aad, aad_len, crypt, crypt_len, S);