One GCM implementation pitfall

If you look at Go’s implementation of GCM, in particular this, you can see that the counter is set to nonce||1:

```go if len(nonce) == gcmStandardNonceSize { // Init counter to nonce||1 copy(counter[:], nonce) counter[gcmBlockSize-1] = 1 } ````

It needs to be. Without it, the first block of keystream is the encryption of 0 if the nonce is 0 (which can happen if nonces are generated from a counter). The encryption of 0 is also… the authentication key!