//TDES128-CFB_block-ENC
//plain
81709944E0CB2E1DB5B0A477D1A8539B
//key
E07099F1BFAFFD7F
240CD790CA4FE134
//iv
C72B6591A0D7DE8F
//cipher
DE658657CEC1D13A4C416ED7E83CAB85


//step
//C1, key=E07099F1BFAFFD7F,crypto=enc
DD5F07CEFABC934E52D7417C07F8EF30
//C2,key=240CD790CA4FE134,cipher=DD5F07CEFABC934E52D7417C07F8EF30,crypto=dec
56D029BFEE32C886DB98EBFDFC35476D
//C3,key=E07099F1BFAFFD7F,plain=56D029BFEE32C886DB98EBFDFC35476D,crypto=enc
00E7549663AB000094840B2FE6190DCC



//TDES128-CFB-ENC
//plain
81709944E0CB2E1D
//key
E07099F1BFAFFD7F
240CD790CA4FE134
//iv
C72B6591A0D7DE8F
//cipher
B3F76EB9504F5B5D

//step
//C1, key=E07099F1BFAFFD7F,crypto=enc
DD5F07CEFABC934E
//C2,key=240CD790CA4FE134,cipher=DD5F07CEFABC934E,crypto=dec
56D029BFEE32C886
//C3,key=E07099F1BFAFFD7F,plain=56D029BFEE32C886,crypto=enc
00E7549663AB0000




//TDES128-CFB-ENC
//plain
81709944E0CB2E1D
//key
E07099F1BFAFFD7F
240CD790CA4FE134
//cipher
C00727761EC27282

//step
//C1, key=E07099F1BFAFFD7F,crypto=enc
60DFC6E3581378FB
//C2,key=240CD790CA4FE134,cipher=60DFC6E3581378FB,crypto=dec
6380CA29F4F4BAB0
//C3,key=E07099F1BFAFFD7F,plain=6380CA29F4F4BAB0,crypto=enc
C00727761EC27282

//---------------------Input---------------------//
//key-16byte
FEFFE9928665731C6D6A8F9467308308
//plain-64byte
d9313225f88406e5a55909c5aff5269a
86a7a9531534f7da2e4c303d8a318a72
1c3c0c95956809532fcf0e2449a6b525
b16aedf5aa0de657ba637b391aafd255
//iv-12byte
cafebabefacedbaddecaf888
//aad-20bytes
feedfacedeadbeeffeedfacedeadbeef
abaddad2000000000000000000000000

//---------------------Output---------------------//
//cipher-64byte
//iv长度12byte，J0=CAFEBABEFACEDBADDECAF88800000001
//ctr-iv（即J1）：CAFEBABEFACEDBADDECAF88800000002
42831ec2217774244b7221b784d0d49c
e3aa212f2c02a4e035c17e2329aca12e
21d514b25466931c7d8f6a5aac84aa05
1ba30b396a0aac973d58e091473f5985
//mac
DA80CE830CFDA02DA2A218A1744F4C76

//构造IV-16byte
cafebabefacedbaddecaf88800000000

blocks=aad||padding(aad)||payload||padding(payload)
注：如果aad或payload实际长度已经分组整数倍，则不需要padding

在chacha20轮函数中，a += b存在回绕
Qround:
  a += b; d ^= a; d <<<= 16;
  c += d; b ^= c; b <<<= 12;
  a += b; d ^= a; d <<<= 8;
  c += d; b ^= c; b <<<= 7;

the constant prime "P" be 2^130-5=0x3fffffffffffffffffffffffffffffffb

//认证域的字节长度，即认证tag（如下用U表示）的字节长度，有效值是在{4,6,8,10,12,14,16}中选取。M越大，则攻击者篡改后仍有效的可能越小，也即越安全。
M
//长度域的长度，即消息字节长度占用的字节数，有效值在2到8个字节（1个字节是保留值）
L
//一次性的认证信息，字节长度是15-L
Nonce
//额外的认证消息，其字节长度表示为len(a)，要求0≤len(a)<2^64
AAD：

//同时加密和MAC
C = Enc(K,M)
T = Mac(M)
//先加密、再MAC
C = Enc(K,M)
T = Enc(C)
//先MAC、再加密  //选择密文攻击
C = Enc(K,(M||Mac(M))

//SM4 example
//key
ffffffffffffffffffffffffffffffff
//iv
ffffffffffffffffffffffffffffffff
//plain
ffffffffffffffffffffffffffffffff
//ECB(key, iv)
EDB119F8455FD2327AD6FBEDCB5B4F5D
//ECB(key, iv) ^ plain
EDB119F8455FD2327AD6FBEDCB5B4F5D ^ ffffffffffffffffffffffffffffffff
=124EE607BAA02DCD8529041234A4B0A2

//《IEEE_1619_2007_standard_for_cryptographic_protection_of_data_on_block_oriented_storage_devices.pdf》
//Input
Key //is the 256 or 512 bit XTS key
P //is the plaintext, bitlen(p)>=128
i //is the value of the 128-bit tweak
//Output
C

//calc step
P = P0||P1||...||Pm
1.for q <- 0 to m-2 do
    Cq = XTS_blockEnc(key, Pj, i, q)
2.b=bit_len(Pm)
3.if b == 0
    Cm-1 = XTS_blockEnc(key,Pm-1, i, m-1)
    Cm = empty
  else
    CC=XTS_blockEnc(key,pm-1,i,m-1)
    Cm=first b bits of CC
    CP=last (128-b) bits of CC
    PP=Pm || CP
    Cm-1=XTS_blockEnc(key,PP,i,m)
4.return C=C1||...||Cm-1||Cm

//XTS_blockEnc calc step
key=key1||key2
T=Enc(key2, i) ⊗ (alpha^j)
PP = P ⊕ T
CC=Enc(key1, PP)
C=CC ⊕ T

//T ⊗ (alpha)// multiply T by alpha
//input：T
//output：T
Cin = 0;
for (j=0;j<16;j++)
{
    Cout=(T[j]>>7)&1
    T[j]=((T[j]<<1)+Cin) & 0xFF
    Cin=Cout
}
if Cout
    T[0]^=0x87//GF_128_FDBK

//XTS AES128_Enc Demo
//Input
//key-256bit-32byte
27F86757EE3A22CF321E2C04931DD95F//key1
9DAD1FD72D56817C4E3E0A49AA462378//key2
//i
11223344556677881122334455667788//must be a block
//plain-33byte
27C066D4F46C716C9C7F7ED01F4B6812
CAE8E5549F276F703D7AEBFA397A74D3
11

//output
6654931E11319CAECDA1801149E740E2
18713E0EC80926DF795E3613E6570E21
01

//block-1
//T = AES128_ECB(key2,i)
D1184F906DB0B8368CC8639E3F337011
//PP = P ⊕ T
27C066D4F46C716C9C7F7ED01F4B6812^
D1184F906DB0B8368CC8639E3F337011
=F6D8294499DCC95A10B71D4E20781803
//CC=Enc(key1, PP)
=Enc(27F86757EE3A22CF321E2C04931DD95F,F6D8294499DCC95A10B71D4E20781803)
=B74CDC8E7C8124984169E38F76D430F3
//C=CC ⊕ T
B74CDC8E7C8124984169E38F76D430F3^
D1184F906DB0B8368CC8639E3F337011
=6654931E11319CAECDA1801149E740E2

//block-2 and block-3 (last)
// T ⊗ (alpha)// multiply T by alpha
a2319e20db60716d1891c73c7f66e022

//calc CC
//CC = Pm-1 ⊕ T
CAE8E5549F276F703D7AEBFA397A74D3^
a2319e20db60716d1891c73c7f66e022
=68D97B7444471E1D25EB2CC6461C94F1
//CC=Enc(key1, CC)
=Enc(27F86757EE3A22CF321E2C04931DD95F,68D97B7444471E1D25EB2CC6461C94F1)
=A33A4CEE7D5D5BCFB8868304988D182B
//CC=CC ⊕ T
A33A4CEE7D5D5BCFB8868304988D182B^
a2319e20db60716d1891c73c7f66e022
=010BD2CEA63D2AA2A0174438E7EBF809

//Cm=first b bits of CC
Cm=01

//PP = Pm||CP=last(128-b) bits of CC
11||0BD2CEA63D2AA2A0174438E7EBF809

//clac Cm-1
// T ⊗ (alpha)// multiply T by alpha
44633c41b6c1e2da30228f79feccc045
//Cm-1 = PP ⊕ T
110BD2CEA63D2AA2A0174438E7EBF809^
44633c41b6c1e2da30228f79feccc045
=5568EE8F10FCC8789035CB411927384C
//Cm-1=Enc(key1, CC)
=Enc(27F86757EE3A22CF321E2C04931DD95F,5568EE8F10FCC8789035CB411927384C)
=5C12024F7EC8C405497CB96A189BCE64
//Cm-1=Cm-1 ⊕ T
5C12024F7EC8C405497CB96A189BCE64^
44633c41b6c1e2da30228f79feccc045
=18713E0EC80926DF795E3613E6570E21

C=C1||Cm-1||Cm
=6654931E11319CAECDA1801149E740E2||18713E0EC80926DF795E3613E6570E21||01

//原始数据-DES
4E6F77206973207468652074696D6520666F7220616C6C20  //3block=24byte=192bit
//Padding Method 1
4E6F77206973207468652074696D6520666F7220616C6C20
//Padding Method 2
4E6F77206973207468652074696D6520666F7220616C6C208000000000000000
//Padding Method 3
00000000000000C04E6F77206973207468652074696D6520666F7220616C6C20
//Padding Method 4
4E6F77206973207468652074696D6520666F7220616C6C20

IV = 00...00
for i = 1 to n //n分组
{
    temp = M_i XOR IV
    temp = Enc(K,temp)
    IV = temp;
}
最后一个密文block作为MAC

//《NIST-SP800-38B》
//Input，两个子密钥生成
Key
block cipher CIPH with block size b
//Output
subKeys K1、K2

//Step
1）当原文长度不是分组长度的整数倍时(10填充)，最后一组明文与k2异或后进行CBC加密
2）当原文长度为分组长度的整数倍时，最后一组明文(不需padding)与k1异或后进行CBC加密
3）T长度至少64bit

当消息为空，block数量为1，即10填充后，与k2异或后进行CBC加密

Prerequisites:
block cipher CIPH with block size b
key K

Output：
subkeys k1,k2

Suggested Notation：
SUBK(K)

Steps:
1.Let L = CIPH_k(0_b)//使用密钥对全0的分组做ECB加密
2.if MSB_1(L) = 0, then k1 = L<<1;
  else k1 = (L<<1) xor B_b //see follow
3.if MSB_1(k1) = 0, then K2 = k1<<1
  else k2 = (k1<<1) xor R_b
4.return k1,k2

R_128 = 0_120||10000111 = (0_15||87)hex
R_64 = 0_59||11011 = (0_7||1B)hex

//AES128-CMAC
//key
e07099f1bfaffd7f240cd790ca4fe134
//k1
7051501d5233e9d2e1f43857dc30888c
//k2
e0a2a03aa467d3a5c3e870afb8611118

L=DES_ECB(key,00.00)=3828A80EA919F4E970FA1C2BEE184446
MSB_1(L)=0,k1=L<<1=7051501d5233e9d2e1f43857dc30888c
MSB_1(k1)=0,k2=(k1<<1) =7051501d5233e9d2e1f43857dc30888c<<1=e0a2a03aa467d3a5c3e870afb8611118

//DES CMAC
 k1: 9cce53a2d96b4d28
 k2: 399ca745b2d69a4b
 key: e07099f1bfaffd7f
//calc subkey
L=DES_ECB(key,00.00)=4E6729D16CB5A694
MSB_1(L)=0,k1=L<<1=9cce53a2d96b4d28
MSB_1(k1)=1,k2=(k1<<1) xor R_b=399CA745B2D69A50 xor 000000000000001B=399CA745B2D69A4B

//msg
616263
//pad
6162638000000000
//pad(msg) XOR k2
58FEC4C5B2D69A4B
//res=Enc(key, (pad(msg) XOR k2))
EE3F707F2C11D297

399CA745B2D69A50
000000000000001B

//msg
248F9D
//msg||padding
248F9D8000000000
//res=Enc(key, (pad(msg) XOR k2))
Enc(1D133AC5B2D69A4B)
=B8F9226E6B34BAE4

//DES CMAC
 k1: 9cce53a2d96b4d28
 k2: 399ca745b2d69a4b
 key: e07099f1bfaffd7f
//calc subkey
L=DES_ECB(key,00.00)=4E6729D16CB5A694
MSB_1(L)=0,k1=L<<1=9cce53a2d96b4d28
MSB_1(k1)=1,k2=(k1<<1) xor R_b=399CA745B2D69A50 xor 000000000000001B=399CA745B2D69A4B

//iv
0000000000000000
//msg
0001020304050607
08090a0b0c0d0e0f
//pad
0001020304050607
08090a0b0c0d0e0f

//cbc加密第一个分组
58BD1B8CEBD10955

//第二分组与k1异或
08090a0b0c0d0e0f xor 9cce53a2d96b4d28
=94C759A9D5664327
//msg
0001020304050607
94C759A9D5664327

//整个msg做cbc
58BD1B8CEBD10955
87B39963013D547F

//SM4-CMAC
//key
E07099F1BFAFFD7F240CD790CA4FE134
k1: 1d016f274a3a18888c48f7e5401a17d2
k2: 3a02de4e947431111891efca80342fa4
//p
000102030405060708090a0b0c0d0e0f
101112131415161718191a1b1c1d1e1f
202122232425262728292a2b2c2d2e2f
303132333435363738393a3b3c3d3e3f
40

//cmac
09D7F12496D4E84C39C05F298FD39DC5

1）IV=0..0
Enc(IV XOR 000102030405060708090a0b0c0d0e0f)=20B93A0C8A401D018464875F408136DE

2)IV=20B93A0C8A401D018464875F408136DE
Enc(IV XOR 101112131415161718191a1b1c1d1e1f)
=Enc(30A8281F9E550B169C7D9D445C9C28C1)
=F1295C1E1FFABBDADC0E909E1E2E2DC2

3)IV=F1295C1E1FFABBDADC0E909E1E2E2DC2
Enc(IV XOR 202122232425262728292a2b2c2d2e2f)
=Enc(D1087E3D3BDF9DFDF427BAB5320303ED)
=DA3AEEDBDBAD4F411C2EA7F7D352138B

3)IV=DA3AEEDBDBAD4F411C2EA7F7D352138B
Enc(IV XOR 303132333435363738393a3b3c3d3e3f)
=Enc(EA0BDCE8EF98797624179DCCEF6F2DB4)
=E557ECCBA0181C95D0EDF6D566064081

//最后block非block整数倍，k2 xor 后加密
3) IV=K2=3a02de4e947431111891efca80342fa4
(K2 XOR 40800000000000000000000000000000)
=(7A82DE4E947431111891EFCA80342FA4)

Enc(E557ECCBA0181C95D0EDF6D566064081 XOR 7A82DE4E947431111891EFCA80342FA4)
=Enc(9FD53285346C2D84C87C191FE6326F25)
=09D7F12496D4E84C39C05F298FD39DC5

//SM4-CMAC
//key
e07099f1bfaffd7fe07099f1bfaffd7f
//plain
e07099f1bfaffd7fe07099f1bfaffd7f
e07099f1bfaffd7fe07099f1bfaffd7f
e07099f1bfaffd7fe07099f1bfaffd7f

//mac
458AB613526E09AB50C7A7B8EC6CD753

//流程
 k1: 22b4c22b9e8e8b9c23c9da876039a8dc
 k2: 456984573d1d17384793b50ec07351b8

1）IV=0..0
Enc(IV XOR block1)=1B2273875F25284EA8823A473CD88E5C

2)IV=1B2273875F25284EA8823A473CD88E5C
Enc(IV XOR block2)
=Enc(1B2273875F25284EA8823A473CD88E5C XOR e07099f1bfaffd7fe07099f1bfaffd7f)
=Enc(fb52ea76e08ad53148f2a3b683777323)
=F76BFA239CC75759CB83F8D78E7B30DF

3) IV=K1=22b4c22b9e8e8b9c23c9da876039a8dc
(K1 XOR block3)
=(22b4c22b9e8e8b9c23c9da876039a8dc XOR e07099f1bfaffd7fe07099f1bfaffd7f)
=(c2c45bda212176e3c3b94376df9655a3)

Enc(c2c45bda212176e3c3b94376df9655a3 XOR F76BFA239CC75759CB83F8D78E7B30DF)
=Enc(35afa1f9bde621ba083abba151ed657c)
=458AB613526E09AB50C7A7B8EC6CD753

//TDES128
//key
E07099F1BFAFFD7F240CD790CA4FE134
k1: f72b4ee8a67f18ae
k2: ee569dd14cfe3147
//p
0001020304050607
08090a0b0c0d0e0f

//std_mac
E4C3593AD6F86AA9

1）IV=0..0
Enc(IV XOR block1)=C0D92C81A7AE8D03

2)IV=C0D92C81A7AE8D03
(k1 xor block2)
=f72b4ee8a67f18ae xor 08090a0b0c0d0e0f
=FF2244E3AA7216A1

CBC(IV, (FF2244E3AA7216A1))
=E4C3593AD6F86AA9

//输入
    K：秘密密钥
    message：消息
    w：压缩分组大小（哈希函数分组大小）
    Tlen：要求的MAC标记长度
//输出
    Tag：MAC标记

1. if length(K) > w then
    K = hash(K)
   else
    对K进行0填充至w字长
2. hmac = hash((opad XOR K) || hash(ipad XOR K || message))
3. 通过只保留前Tlen字节作为Tag

注：
1）ipad为00110110(0x36)的循环，直到达到单项散列函数的分组长度。
2）opad为01011100(0x5C)的循环，直到达到单项散列函数的分组长度。

//手动计算与在线计算验证HSHA256（分组512bit，输出256bit）
M：ABC（hex格式：616263）
K：313233343536（hex格式）
alg：SHA256
//在线计算
res：f6ced6f4883ffc0981a6b9945819f680102b43097ad8ef7a0df9bde06fb3d2e4

//手动计算，运算过程均为hex，验证成功
//K = K(pad)
31323334353600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
//ipadKey = ipad XOR K:
36363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636^
31323334353600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
=07040502030036363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636
//opadKey = opad XOR K
5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C^
31323334353600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
=6D6E6F68696A5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C
//SHA256(ipadKey || meassage)
=SHA256(07040502030036363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636||616263)
=29B4C2EE6B7392016EEB0E5729790C1F299B551F54902E78AD049BC33D8EF29C
//Tag=SHA256(opadKey||SHA256(ipadKey || meassage))
SHA256(6D6E6F68696A5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C||29B4C2EE6B7392016EEB0E5729790C1F299B551F54902E78AD049BC33D8EF29C)
=F6CED6F4883FFC0981A6B9945819F680102B43097AD8EF7A0DF9BDE06FB3D2E4

//Input
Key //128bit
Plaintext //could be NULL
//preprocess：calc subkey
t1 = 0x010101010101010101010101010101
t2 = 02020202020202020202020202020202
t3 = 03030303030303030303030303030303
K1 = AES128_ECB_ENC(Key, t1)
K2 = AES128_ECB_ENC(Key, t2)
k3 = AES128_ECB_ENC(Key, t3)
//Output
Mac //occupy 12 Bytes

//Step
1）初始iv全0
2）中间block进行CBC运算
1）当原文长度不是分组长度的整数倍时(10填充)，最后一组明文与k3异或后进行CBC加密
2）当原文长度为分组长度的整数倍时，最后一组明文(padding)与k2异或后进行CBC加密
//《NIST-SP800-38B》

//CCM
//5.1 底层块密码算法和密钥的选择
the forward cipher function前向密码函数是对固定比特长度的比特串的函数，长度为块，128位
//5.2 两个加密原语的操作讨论要求
向前密码功能、CTR模式
//5.3 CCM元素
A：附加认证数据，可以为空，CCM没有为A提供保密性
P：CCM保护的数据消息组成
N：用一次的位串，不要求随机
T：CCM-MAC值
//5.4 有效数据元素讨论-输入格式化
1.第一块B0,唯一确定的Nonce
2.第一块B0，独特于其他技术块（整个调用过程中）
3....
4.格式化函数对N、P、A、Tlen有长度限制，例如Tlen<32的无效
//5.5 操作和function的例子
LBS3(111011010) = 010
MBS4(111011010) = 1110
lg(2^10) = 10

//CCM规格
1.计数器可以被使用前任何时间生成
//生成-加密过程
1.先行条件
    块加密算法、Key、计数器生成函数、格式化函数、MAC长度TLen
2.输入
    N（Nonce）、P（有效负载明文）、A（附加认证数据）
3.输出
    C（密文）
4.Steps
    1) 应用格式化函数从(N、A、P)生成B0，...，Br
    2) Set Y0 = CIPHK(B0)
    3) for i=1 to r do {Yi = CIPHK(Bi XOR Yi-1)}
    4) Set T = MSB_TLen(Yr)
    5) 利用计数器生成函数生成Ctr0，...，Ctrm，其中m = PLen/128
    6) for j=1 to m do {Sj = CIPHK(Ctrj)}
    7) Set S = S1||S2||...||Sm
    //以下看是密文+Mac
    8) Return C = (P XOR MSB_PLen(S))||(T XOR MSB_TLen(S0))

//解密-认证
1.先行条件
    块加密算法、Key、计数器生成函数、格式化函数、MAC长度TLen
2.输入
    N（Nonce）、C（密文）、A（附加认证数据）
3.输出
    P（明文）或者错误信息
4.Steps
    1) if CLen < T,return INVALID
    2) 利用计数器生成函数生成Ctr0，...，Ctrm，其中m = PLen/128
    3) for j=1 to m do {Sj = CIPHK(Ctrj)}
    4) Set S = S1||S2||...||Sm
    5) Set P = MSB_Clen-Tlen(C) XOR MSB_Clen-Tlen(S) //把T去掉，异或恢复明文
    6) Set T = LSB_Clen-Tlen(C) XOR MSB_Clen-Tlen(C)
    7) 应用格式化函数从(N、A、P)生成B0，...，Br
    8) Set Y0 = CIPHK(B0)
    9) for i=1 to r do {Yi = CIPHK(Bi XOR Yi-1)}
    10) if T != MSB_Tlen(Yr) return INVALID
        else return P

//AES CCM有两个参数：
//M表示完整性检查值（ICV）的大小。CCM定义了4、6、8、10、12、14和16个八位字节的值；但是，为了保持对齐并提供足够的安全性，只允许使用四的倍数且至少为八的值。实现必须支持8个八位字节和16个八位字节的M值，并且实现可以支持12个八位字节的M值。
M  

//L表示长度字段的大小（以八位字节为单位）。CCM定义2个八位字节和8个八位字节之间的L值。本规范仅支持L=4。实现必须支持4个八位字节的L值，这可以容纳一个完整的巨型程序[JUMBO]；但是，长度包括所有加密数据，其中还包括ESP Padding、Pad length和Next Header字段。
L

//CCM发起人处理有4个输入
//密钥单个密钥用于使用CBC-MAC计算ICV，并使用计数器模式执行有效负载加密。AES支持128位、192位和256位的密钥大小。默认键大小为128位，实现必须支持此密钥大小。实现还可以支持192位和256位的密钥大小。
Key

//nonce nonce的大小取决于为参数L选择的值。它是15-L八位字节。实现必须支持11个八位字节的nonce。第4节描述了nonce的构造
Nonce

//有效载荷ESP数据包的有效载荷。有效载荷不得超过4294967295个八位字节，这是一个巨型程序[JUMBO]的最大大小；但是，ESP Padding、Pad Length和Next Header字段也是有效负载的一部分。
ESP //ESP = IV(8 octets) || Encrypted Payload || Authentication

//AAD CCM为有效负载之外的某些数据提供数据完整性和数据源身份验证。CCM不允许附加认证数据（AAD）的长度超过18446744073709551615个八位字节。ICV根据ESP标题、有效载荷和ESP拖车字段计算，该字段明显小于CCM施加的限制。第5节中描述的AAD施工
AAD

//CCM Mode Specification
//身份验证字段的大小。M值的选择涉及消息扩展和攻击者无法检测到修改消息的可能性之间的权衡。有效值为4、6、8、10、12、14和16个八位字节
M

//长度字段的大小。此值需要在最大消息大小和Nonce大小之间进行权衡。不同的应用程序需要不同的权衡，因此L是一个参数。L的有效值范围在2个八位字节和8个八位字节之间（保留值L=1）
L

//Input
//分组密码的加密密钥K
Key

//15-L个八位组的一个非正数N，唯一值，对使用相同密钥加密的两条不同消息使用相同Nonce会破坏此模式的安全属性
//有效长度：7-13字节（15-L）
N

//消息M
M

//附加认证数据，此附加数据经过身份验证但未加密，不包含在此模式的输出中，可用于验证明文数据包头，或影响消息解释的上下文消息。不希望验证其他数据的用户可以提供长度为0的字符串
aad

//计算认证字段T步骤
//1.定义B_0...B_n序列
字节序号：   0     || 1..15-L || 16-L...15
内容    ： Flags       Nonce       Len(M)
//Flags of B_0
位序号：    7           ||  6   ||5..3  ||2..0
内容  ： Reserved（通常为0）  Adata     M'    L'
if len(aad)>0 Adata = 1 else Adata = 0
M' = [1,7]
L' = L-1,保留0值  //Len(M)

//2.使用CTR模式，定义密钥流块
S_i = E(K, A_i) for i=0 to ... //S_0不用于加密消息
//值A_i的格式
位序号：0   ||  1..15-L ||  16-L..15
内容 ：Flags    Nonce       Counter_i

//CBC-MAC计算流程
X_1 = E(K, B_0)
X_i+1 = E(K, X_i XOR B_i) for i=1 to n
T = first_M_bytes(X_n+1)

//-------------------------Input5---------------------------
//key-AES128-16bytes
27F86757EE3A22CF321E2C04931DD95F
//Nonce-7Bytes //有效位7-13bytes //so L=15-7=8
11223344556677
//AAD-15bytes 
D3691BC11966725BAD706DD7FAEF81
//plaintext-0bytes
NULL
//M=length(Mac)
6
//-------------------------Output5---------------------------
//cipher
NULL
//Tag
CA0EE26E9FE4


//B0-hex
57
11223344556677
0000000000000000
//Flag-bin，对应hex(‭00010111‬)=0x17
0//Reserved (always is 0)
1//Adata(if len(aad) > 0, value is 1，else value is 0)
010//M' = (M-2)/2, so M' = [1,7]
111//L' = L -1, so L' = [0,7]

//S0 - CTR IV
07//0Flags（对于Si, bit[0:3]为L', 其余bit为0），即Flags=L’
11223344556677//Nonce N
0000000000000000//Counter i

//blocks
57112233445566770000000000000000
000FD3691BC11966725BAD706DD7FAEF
81000000000000000000000000000000

//将blocks带入CBC计算得到最后一组block
D4A26C759CAF5A1330991E8563756A8C
//中间tag值，最后一组block，截取前M字节，并0填充(其实没必要做，因为ctr字节流加密，不影响前M字节)
D4A26C759CAF00000000000000000000
//IV为S0=07112233445566770000000000000000，中间tag值进行CTR加密计算，得
CA0EE26E9FE43C255FFD2386AE216B85
//Mac
CA0EE26E9FE4

//-------------------------Input4---------------------------
//key-AES128-16bytes
27F86757EE3A22CF321E2C04931DD95F
//Nonce-7Bytes //有效位7-13bytes //so L=15-7=8
11223344556677
//AAD-0bytes 
NULL
//plaintext-16bytes
NULL
//M=length(Mac)
6
//-------------------------Output4---------------------------
//cipher
NULL
//Tag
C246B98F34CC


//B0-hex
17
11223344556677
0000000000000000
//Flag-bin，对应hex(‭00010111‬)=0x17
0//Reserved (always is 0)
0//Adata(if len(aad) > 0, value is 1，else value is 0)
010//M' = (M-2)/2, so M' = [1,7]
111//L' = L -1, so L' = [0,7]

//S0 - CTR IV
07//0Flags（对于Si, bit[0:3]为L', 其余bit为0），即Flags=L’
11223344556677//Nonce N
0000000000000000//Counter i

//blocks
17112233445566770000000000000000

//将blocks带入CBC计算得到最后一组block
DCEA379437877AB8CCD74C12F01F31BE
//中间tag值，最后一组block，截取前M字节，并0填充(其实没必要做，因为ctr字节流加密，不影响前M字节)
DCEA3794378700000000000000000000
//IV为S0=07112233445566770000000000000000，中间tag值进行CTR加密计算，得
C246B98F34CC66366F643D03CD540109
//Mac
C246B98F34CC

//-------------------------Input3---------------------------
//key-AES128-16bytes
27F86757EE3A22CF321E2C04931DD95F
//Nonce-7Bytes //有效位7-13bytes //so L=15-7=8
11223344556677
//AAD-0bytes 
NULL
//plaintext-16bytes
3A1A07582FEECD2F6C42D18A04189082
//M=length(Mac)
6
//-------------------------Output3---------------------------
//cipher
B82F54D9D7AE4D0E739BA821416A4C46
//Tag
F6049BE2C785


//B0-hex
17
11223344556677
0000000000000010
//Flag-bin
//0x17
0
0
010
111

//S0
07
11223344556677
0000000000000000

//blocks
17112233445566770000000000000010
3A1A07582FEECD2F6C42D18A04189082

//将blocks带入CBC计算(IV为全0)得到最后一组block 
E8A815F9C4CEF6326EA31BA1E12232A3
//中间tag值，最后一组block，截取前M字节，并0填充
E8A815F9C4CE00000000000000000000
//IV为S0=07112233445566770000000000000000，中间tag值进行CTR加密计算，得
F6049BE2C78566366F643D03CD540109
//Mac
F6049BE2C785
//计算密文，IV++，CTR加密
B82F54D9D7AE4D0E739BA821416A4C46

//-------------------------Input1---------------------------
//key-AES128-16bytes
27F86757EE3A22CF321E2C04931DD95F
//Nonce-7Bytes //有效位7-13bytes //so L=15-7=8
11223344556677
//AAD-15bytes 
D3691BC11966725BAD706DD7FAEF81
//plaintext-16bytes
3A1A07582FEECD2F6C42D18A04189082
//M=length(Mac)
6
//-------------------------Output1---------------------------
//cipher
B82F54D9D7AE4D0E739BA821416A4C46
//Tag
198455B4E0AE


//B0-hex
57
11223344556677//Nonce
0000000000000010 //8byte, length(msg)
//Flag-bin
//0x57
0
1
010
111

//S0
07//注意非57，flag=L'
11223344556677
0000000000000000

//blocks
//B0||B1(2byte)||pad(AAD)||pad(msg)
57112233445566770000000000000010
000FD3691BC11966725BAD706DD7FAEF //注意此处前2byte，代表aad实际长度
81000000000000000000000000000000
3A1A07582FEECD2F6C42D18A04189082


//将blocks带入CBC计算得到最后一组block //CBC IV为0
0728DBAFE3E5D9E6A61FA10CE9DA281F
//中间tag值，最后一组block，截取前M字节，并0填充
0728DBAFE3E500000000000000000000
//IV为S0（即A0）=07112233445566770000000000000000，中间tag值进行CTR加密计算，得
198455B4E0AE66366F643D03CD540109
//Mac
198455B4E0AE
//计算密文，IV++，CTR加密
B82F54D9D7AE4D0E739BA821416A4C46//加密可以并行，因为S0已知


//-------------------------Input2---------------------------
//key-AES128-16bytes
27F86757EE3A22CF321E2C04931DD95F
//Nonce-7Bytes //有效位7-13bytes //so L=15-7=8
11223344556677
//AAD-15bytes 
D3691BC11966725BAD706DD7FAEF81
//plaintext-16bytes
3A1A07582FEECD2F6C42D18A04189082
//M=length(Mac)
16
//-------------------------Output2---------------------------
//cipher
B82F54D9D7AE4D0E739BA821416A4C46
//Tag
BD9DE8763952F5AFD0E112B056A084A3


//B0-hex
7F
11223344556677
0000000000000010
//Flag-bin
//0x7F
0
1
111
111

//block
7F112233445566770000000000000010
000FD3691BC11966725BAD706DD7FAEF
81000000000000000000000000000000
3A1A07582FEECD2F6C42D18A04189082

//blocks带入CBC_MAC，得
A331666D3A199399BF852FB39BF485AA
//中间Tag值，截取前M字节，0填充
A331666D3A199399BF852FB39BF485AA
//IV=S0
07112233445566770000000000000000
//中间Tag值进行CTR加密
BD9DE8763952F5AFD0E112B056A084A3
//计算cipher，iv++
B82F54D9D7AE4D0E739BA821416A4C46

void ccm_get_B0(uint8_t *nonce, uint8_t M, uint8_t L, uint32_t aad_bytes, uint32_t payload_byte, uint8_t out[16])
{
    uint8_t tmp[4];

    //B0 Flag
    out[0] = 0;
    out[0] |= (M - 2) / 2;
    out[0] <<= 3;
    out[0] |= L - 1;

    if (aad_bytes)
    {
        out[0] |= 0x40;
    }

    //B0 nonce
    if (nonce != out + 1)
    {
        memcpy_(out + 1, nonce, 15 - L);
        memset_(out + 1 + 15 - L, 0, L);
    }

    reverse_byte_array((uint8_t *)&payload_byte, tmp, 4);

    if (L <= 4)
    {
        memcpy_(out + 16 - L, tmp + 4 - L, L);
    }
    else
    {
        memcpy_(out + 16 - 4, tmp, 4);
    }
}

void ccm_get_B1(uint8_t *aad, uint32_t aad_bytes, uint32_t *aad_offset, uint8_t out[16])
{
    uint8_t tmp[4];
    uint32_t current_bytes, left_bytes;

    reverse_byte_array((uint8_t *)&aad_bytes, tmp, 4);

    if (aad_bytes < ((1 << 16) - (1 << 8)))
    {
        memcpy_(out, tmp + 2, 2);
        current_bytes = 2;
        left_bytes = 16 - 2;
    }
    else
    {
        out[0] = 0xFF;
        out[1] = 0xFE;
        memcpy_(out + 2, tmp, 4);
        current_bytes = 6;
        left_bytes = 16 - 6;
    }

    if (aad_bytes <= left_bytes)
    {
        memcpy_(out+current_bytes, aad, aad_bytes);
        memset_(out + current_bytes + aad_bytes, 0, left_bytes - aad_bytes);
        *aad_offset = aad_bytes;
    }
    else
    {
        memcpy_(out + current_bytes, aad, aad_bytes);
        *aad_offset = left_bytes;
    }
}

//《RFC3610规范》测试数据验证
//部分流程跟网上一些论文有出入
//https://www.doc88.com/p-3793128718693.html?r=1
//Input
T_L             = 8 //输出Mac的长度，字节
AES Key = C0 C1 C2 C3  C4 C5 C6 C7  C8 C9 CA CB  CC CD CE CF
Nonce   = 00 00 00 03  02 01 00 A0  A1 A2 A3 A4  A5
Total packet length = 31. [Input with 8 cleartext header octets]
          00 01 02 03  04 05 06 07  08 09 0A 0B  0C 0D 0E 0F
          10 11 12 13  14 15 16 17  18 19 1A 1B  1C 1D 1E


//Output
Total packet length = 39. [Authenticated and Encrypted Output]
          00 01 02 03  04 05 06 07  58 8C 97 9A  61 C6 63 D2
          F0 66 D0 C2  C0 F9 89 80  6D 5F 6B 61  DA C3 84 17
          E8 D1 2C FD  F9 26 E0


//1.提取信息
//K
C0C1C2C3C4C5C6C7C8C9CACBCCCDCECF

//IV
5900000003020100A0A1A2A3A4A50017 //IV构造
//IV_Enc = Enc(K,IV)
=EB9D5547730955AB231E0A2DFE4B90D6

//M（带有8个明文标题八位字节的输入）
000102030405060708090A0B0C0D0E0F
101112131415161718191A1B1C1D1E

//Nonce，长度13字节
00000003020100A0A1A2A3A4A5
//T，长度8字节




//2.对报文进行分组
//M1构造：len(aad)用2字节表示 || packet header || zero padding
M1=00080001020304050607000000000000 
M2=08090A0B0C0D0E0F1011121314151617 //开始从原文划分
M3=18191A1B1C1D1E000000000000000000 //00填充




//3.计算T_CBC-MAC
//Block_1 = E(K,IV_Enc^M1)
=E(K,EB9D5547730955AB231E0A2DFE4B90D6^00080001020304050607000000000000)
=E(K,EB955546710A51AE25190A2DFE4B90D6)
=CDB6411E3CDC9B4F5D9258B69EE7F091

//Block_2 = E(K,Block_1^M2)
=E(K,CDB6411E3CDC9B4F5D9258B69EE7F091^08090A0B0C0D0E0F1011121314151617)
=(K,C5BF4B1530D195404D834AA58AF2E686)
=9C38405EA03C1BC904B58B40C76CA2EB

//Block_3 = E(K,Block_2^M3)
=E(K,9C38405EA03C1BC904B58B40C76CA2EB^18191A1B1C1D1E000000000000000000)
=(K,84215A45BC2105C904B58B40C76CA2EB)
=2DC697E411CA83A860C2C406CCAA542F

//T_CBC-MAC = Block_3[0:T_L-1]
=2DC697E411CA8 //取最后一分组密文前T_L字节




//4.计数器CTR加密计算
//A_0
=Enc(K,01||Nonce||0000)
=Enc(K,0100000003020100A0A1A2A3A4A50000)
=3A2E46C8EC33A5485620542C022CC07D
//A_0_first_T_M //截取结果前T_M长度数据
=3A2E46C8EC33A54

//计数器CTR加密计算
//CTR[0000] = 01||Nonce||0001
0100000003020100A0A1A2A3A4A50001

//CTR[0001]
E(K,CTR[0000])
=E(K,0100000003020100A0A1A2A3A4A50001)
=50859D916DCB6DDDE077C2D1D4EC9F97

//CTR[0002]
=E(K,CTR[0001])
=E(K,0100000003020100A0A1A2A3A4A50002)
=7546717AC6DE9AFF640C9C06DE6D0D8F

//CTR[MAC]，未知，结果好像没用到
=E(K,CTR[0002])
=E(K,0100000003020100A0A1A2A3A4A50003)
=1E22952AEC3F6B8BB2AE125FF7E3986C //测试答案是3A2E46C8EC33A548




//5.CBC计算分组密文C
//M（已去掉前面带有8个明文标题八位字节的输入）
M1 = 08090A0B0C0D0E0F1011121314151617
M2 = 18191A1B1C1D1E000000000000000000

//C
C1 = M1^CTR[0001]
=08090A0B0C0D0E0F1011121314151617^50859D916DCB6DDDE077C2D1D4EC9F97
=588C979A61C663D2F066D0C2C0F98980
C1 = M2^CTR[0002]
=18191A1B1C1D1E000000000000000000^7546717AC6DE9AFF640C9C06DE6D0D8F
=6D5F6B61DAC384//截取有效长度6D5F6B61DAC384FF640C9C06DE6D0D8F



//6.计算T-CCM 
T-CCM = T_CBC-MAC^A_0_first_T_M
2DC697E411CA83A8^3A2E46C8EC33A54
=17E8D12CFDF926E0


//合并结果hdr||C||T-CCM
0001020304050607||
588C979A61C663D2F066D0C2C0F98980||
6D5F6B61DAC384||
17E8D12CFDF926E0

//根据规范上的测试数据，手动计算了解流程
测试用例 #2：AES-XCBC-MAC-96 与 3 字节输入
密钥（K）：000102030405060708090a0b0c0d0e0f
明文 (M) : 000102
AES-XCBC-MAC：5b376580ae2f19afe7219ceef172756f
AES-XCBC-MAC-96：5b376580ae2f19afe7219cee

//第一步，初始化
//Key，16字节128bit
000102030405060708090a0b0c0d0e0f
//M（填充）至分组长度，10*方式，M[1]
00010280000000000000000000000000
//IV，初始0000*
00000000000000000000000000000000

//**********参数配置**********
//从128位密钥中导出3个128bit密钥
//K1 
0x01010101010101010101010101010101
//AES(Key,K1,ECB)
C352805754237F311AC0FFF4E3E03E78

//K2
0x02020202020202020202020202020202
//AES(Key,K2,ECB)
BD862FFB97AD2FB8F8B891F6032F36CB

//K3
0x03030303030303030303030303030303
//AES(Key,K3,ECB)
C1A7ABA1A23A94065807A08CC8EED06E

//E[0]
00000000000000000000000000000000

//验证成功
//当最后一分组不满128bit时，bit位10*补足，下面已补足
Enc(K1,M[n]^E[n-1]^K3)
=Enc(K1,00010280000000000000000000000000^00000000000000000000000000000000^C1A7ABA1A23A94065807A08CC8EED06E)
=Enc(K1,00010280000000000000000000000000^C1A7ABA1A23A94065807A08CC8EED06E)
=Enc(C352805754237F311AC0FFF4E3E03E78,C1A6A921A23A94065807A08CC8EED06E)
=5B376580AE2F19AFE7219CEEF172756F
//从左往右取96bit=12字节数据
5B376580AE2F19AFE7219CEE

测试用例 #3：AES-XCBC-MAC-96 与 16 字节输入
密钥（K）：000102030405060708090a0b0c0d0e0f
消息（M）：000102030405060708090a0b0c0d0e0f
AES-XCBC-MAC：d2a246fa349b68a79998a4394ff7a263
AES-XCBC-MAC-96：d2a246fa349b68a79998a439

//Key
000102030405060708090a0b0c0d0e0f
//M
000102030405060708090a0b0c0d0e0f
//K1 
Enc(key,K1)
=Enc(Key,01010101010101010101010101010101)
=C352805754237F311AC0FFF4E3E03E78

//K2
Enc(key,K2)
=Enc(Key,02020202020202020202020202020202)
=BD862FFB97AD2FB8F8B891F6032F36CB

//K3
Enc(key,K3)
=Enc(Key,03030303030303030303030303030303)
=C1A7ABA1A23A94065807A08CC8EED06E

//E[0]
00000000000000000000000000000000

Enc(K1,M[n]^E[n-1]^K1)
=Enc(K1,000102030405060708090a0b0c0d0e0f^00000000000000000000000000000000^BD862FFB97AD2FB8F8B891F6032F36CB)
=Enc(K1,000102030405060708090a0b0c0d0e0f^BD862FFB97AD2FB8F8B891F6032F36CB)
=Enc(K1,BD872DF893A829BFF0B19BFD0F2238C4)
=Enc(C352805754237F311AC0FFF4E3E03E78,BD872DF893A829BFF0B19BFD0F2238C4)
=D2A246FA349B68A79998A4394FF7A263

测试用例 #1：AES-XCBC-MAC-96 与 0 字节输入
密钥（K）：000102030405060708090a0b0c0d0e0f
消息（M）：<空字符串>
AES-XCBC-MAC：75f0??251d528ac01c4573dfd584d79f29
AES-XCBC-MAC-96：75f0??251d528ac01c4573dfd5

//Key
000102030405060708090a0b0c0d0e0f
//M
NULL
//M[n],注意比特位是10*填充，转到字节为80开头
80000000000000000000000000000000

//K1
Enc(key,K1)
=Enc(Key,01010101010101010101010101010101)
=C352805754237F311AC0FFF4E3E03E78

//K3
Enc(key,K3)
=Enc(Key,03030303030303030303030303030303)
=C1A7ABA1A23A94065807A08CC8EED06E

Enc(K1,M[n]^E[n-1]^K3)
=Enc(K1,80000000000000000000000000000000^00000000000000000000000000000000^C1A7ABA1A23A94065807A08CC8EED06E)
=Enc(K1,80000000000000000000000000000000^C1A7ABA1A23A94065807A08CC8EED06E)
=Enc(K1,41A7ABA1A23A94065807A08CC8EED06E)
=Enc(C352805754237F311AC0FFF4E3E03E78,D1A7ABA1A23A94065807A08CC8EED06E)
=75F0251D528AC01C4573DFD584D79F29

测试用例 #4：AES-XCBC-MAC-96 与 20 字节输入
密钥（K）：000102030405060708090a0b0c0d0e0f
消息（M）：000102030405060708090a0b0c0d0e0f10111213
AES-XCBC-MAC：47f51b4564966215b8985c63055ed308
AES-XCBC-MAC-96：47f51b4564966215b8985c63

//Key
000102030405060708090a0b0c0d0e0f

//M[1]
000102030405060708090a0b0c0d0e0f
//M[2]
10111213800000000000000000000000

//E[0]
00000000000000000000000000000000

//K1
Enc(key,K1)
=Enc(Key,01010101010101010101010101010101)
=C352805754237F311AC0FFF4E3E03E78

//K3
Enc(key,K3)
=Enc(Key,03030303030303030303030303030303)
=C1A7ABA1A23A94065807A08CC8EED06E

CBC-MAC:先XOR，再Enc，C作为下一组的IV

//计算E[i]（需要参数：明文，K1密钥，不需要密文参与）
//只需要计算到分组个数
E[0] = 00000000000000000000000000000000
E[1]
=Enc(K1,M[1]^E[0])
=Enc(K1,000102030405060708090A0B0C0D0E0F^00000000000000000000000000000000)
=Enc(K1,000102030405060708090A0B0C0D0E0F)
=1D0448FACF4D9C6F55B993DA09803DB3


//第一分组
Enc(Key,M[1]^E[0])
=Enc(Key,000102030405060708090a0b0c0d0e0f^00000000000000000000000000000000)
=Enc(000102030405060708090a0b0c0d0e0f,000102030405060708090a0b0c0d0e0f)
=0A940BB5416EF045F1C39458C653EA5A

//最后一分组，原文分组不满128bits
Enc(K1,M[2]^E[1]^K3)
=Enc(K1,10111213800000000000000000000000^1D0448FACF4D9C6F55B993DA09803DB3^C1A7ABA1A23A94065807A08CC8EED06E)
=Enc(K1,0D155AE94F4D9C6F55B993DA09803DB3^C1A7ABA1A23A94065807A08CC8EED06E)
=Enc(K1,CCB2F148ED7708690DBE3356C16EEDDD)
=Enc(C352805754237F311AC0FFF4E3E03E78,CCB2F148ED7708690DBE3356C16EEDDD)
=47F51B4564966215B8985C63055ED308

测试用例 #6：AES-XCBC-MAC-96 与 34 字节输入
密钥（K）：000102030405060708090a0b0c0d0e0f
消息（M）：000102030405060708090a0b0c0d0e0f10111213141516171819
                    1a1b1c1d1e1f2021
AES-XCBC-MAC：becbb3bccdb518a30677d5481fb6b4d8
AES-XCBC-MAC-96：becbb3bccdb518a30677d548


//Key
000102030405060708090a0b0c0d0e0f
//M[1]
000102030405060708090a0b0c0d0e0f
//M[2]
101112131415161718191a1b1c1d1e1f
//M[3]
20218000000000000000000000000000

//K1
Enc(key,K1)
=Enc(Key,01010101010101010101010101010101)
=C352805754237F311AC0FFF4E3E03E78
//K3
Enc(key,K3)
=Enc(Key,03030303030303030303030303030303)
=C1A7ABA1A23A94065807A08CC8EED06E

//E[0]
00000000000000000000000000000000
//E[1]
=Enc(K1,M[1]^E[0])
=Enc(C352805754237F311AC0FFF4E3E03E78,000102030405060708090a0b0c0d0e0f)
=1D0448FACF4D9C6F55B993DA09803DB3
//E[2]
=Enc(K1,M[2]^E[1])
=Enc(K1,101112131415161718191a1b1c1d1e1f^1D0448FACF4D9C6F55B993DA09803DB3)
=Enc(K1,101112131415161718191a1b1c1d1e1f^1D0448FACF4D9C6F55B993DA09803DB3)
=Enc(C352805754237F311AC0FFF4E3E03E78,0D155AE9DB588A784DA089C1159D23AC)
=09025E5A6725207244145C6B80668579

//第1分组运算C1
Enc(Key,M[1]^E[0])
=Enc(000102030405060708090a0b0c0d0e0f,000102030405060708090a0b0c0d0e0f)
=0A940BB5416EF045F1C39458C653EA5A
//第2分组运算C2
Enc(Key,101112131415161718191A1B1C1D1E1F^1D0448FACF4D9C6F55B993DA09803DB3)
=Enc(000102030405060708090a0b0c0d0e0f,0D155AE9DB588A784DA089C1159D23AC)
=9D35AF36E5755C77C7B9814EB90F5E8A

//不涉及上面两分组加密运算
//最后一分组C3，原文分组不满128bits
Enc(K1,M[3]^E[2]^K3)
=Enc(K1,20218000000000000000000000000000^09025E5A6725207244145C6B80668579^C1A7ABA1A23A94065807A08CC8EED06E)
=Enc(K1,2923DE5A6725207244145C6B80668579^C1A7ABA1A23A94065807A08CC8EED06E)
=Enc(C352805754237F311AC0FFF4E3E03E78,E88475FBC51FB4741C13FCE748885517)
=BECBB3BCCDB518A30677D5481FB6B4D8

//Input
Key
IV //any number of bits between 1 and 2^64
Plaintext //any number of bits between 0 and 2^39 - 256
AAD // any number of bits between 0 and 2^64

//Output
Ciphertext //as same as Plaintext length
Tag //whose bits length can be value between 64 and 128