Tony Arcieri

> I've personally found dealing with CTAP to be very time consuming and difficult so if more people can benefit from it we should see what can be done to...

Are you trying to use `polyval` directly, or `ghash`? You should probably use `ghash` to have it handle the conversions for you.

Okay, that's not going to make things easy. It looks like you're not reversing the inputs or outputs, for starters.

It still seems like you aren't reversing the inputs. Perhaps you should try to get the basic GHASH working before you move on?

GHASH has test vectors. The `ghash` crate works. You should probably start by trying to reproduce those test vectors in your own code before moving on. > I've done a.reverse...

I meant that you should try to implement GHASH itself in terms of the `polyval` crate, and get it to where it's matching the GHASH test vectors, before trying to...

There's a bug somewhere in your code, and since your examples aren't complete / runnable I can't tell where. That's why I was suggesting you at least get GHASH right,...

We could potentially add a `polyval::hazmat` module which exposes an abstraction over the low-level operations, and then wrap that up in an additional `ghash::hazmat` module to make it easier to...

The `ssh-cipher` API is an extraction from `ssh-key` and largely designed around the concerns of encrypting SSH private key files, so it's possible that its API is somewhat unhelpful for...

We can support it, yes, though I would suggest implementing the AEAD modes first before deciding on an abstraction. (Really the AEAD modes are the only thing a modern implementation...