Detailed Description

AES-128 block cipher and AEAD_AES_128_GCM (RFC 5116 / NIST SP 800-38D).

The QUIC Initial packet protection AEAD is AEAD_AES_128_GCM (RFC 9001 sec 5.3), and header protection samples a keystream block from AES-128 in ECB mode (sec 5.4). Both need a single primitive: encrypt one 16-byte block under a 128-bit key. GCM's counter mode and its GHASH authenticator are then layered on top in software.

This mirrors the SSH cipher split: on Arduino (ESP32) the AES block is mbedtls, routed to the hardware AES accelerator; on native host builds a compact software AES-128 is used so the whole AEAD is unit-testable off-target. GHASH and the counter loop are the same software on both.

Pure, zero heap, host-tested against the NIST GCM test vectors and RFC 9001 Appendix A.

Author: Douglas Quigg (dstroy0)

Date: 2026

Definition in file quic_aead.h.