Expand description
Test the AES-256-GCM implementation using NIST SP 800-38D test vectors.
Each test vector is run twice: once encrypting, once decrypting. The following cases are covered (0-indexed to match the internal array):
Vec 0 — empty plaintext, 16-byte AAD (GMAC / auth-only) Vec 1 — 16-byte plaintext, empty AAD (encrypt + tag, no AAD) Vec 2 — 16-byte plaintext, 16-byte AAD (full AEAD) Vec 3 — plaintext exactly one block (16 B) (boundary: single block) Vec 4 — plaintext exactly one block (16 B) + AAD (boundary: single block + large AAD) Vec 5 — plaintext 13 bytes + large AAD (partial block payload) Vec 6 — tampered tag: decryption must explicitly report tag_is_valid = false
Buffer layout for each vector: [aad_offset .. message_offset] — AAD bytes [message_offset .. message_offset+msg_len] — plaintext (enc) / ciphertext (dec) [message_offset+msg_len ..] — tag (written by enc, checked by dec)