aes_gctr
aes_gctr(aes, J0inc, in, len, out);
aes_gctr(aes, J0, S, sizeof(S), tag);
aes_gctr(aes, J0, S, sizeof(S), T);