AlgorithmType: AuthenticatedSymmetricCipher
Name: XAES-256-GCM
Source: C2SP XAES-256-GCM specification (https://c2sp.org/XAES-256-GCM)

# Test vector 1: MSB of L is 0 (no polynomial reduction in K1 derivation)
# Key: all 0x01 bytes
# Nonce: ASCII "ABCDEFGHIJKLMNOPQRSTUVWX" (24 bytes)
# Plaintext: ASCII "XAES-256-GCM" (12 bytes)
# AAD: empty
Key: 0101010101010101010101010101010101010101010101010101010101010101
IV: 4142434445464748494a4b4c4d4e4f505152535455565758
Plaintext: 584145532d3235362d47434d
Ciphertext: ce546ef63c9cc60765923609
Header:
MAC: b33a9a1974e96e52daf2fcf7075e2271
Test: Encrypt

# Test vector 2: MSB of L is 1 (polynomial reduction 0x87 XOR in K1 derivation)
# Key: all 0x03 bytes
# Nonce: ASCII "ABCDEFGHIJKLMNOPQRSTUVWX" (24 bytes)
# Plaintext: ASCII "XAES-256-GCM" (12 bytes)
# AAD: ASCII "c2sp.org/XAES-256-GCM" (21 bytes)
Key: 0303030303030303030303030303030303030303030303030303030303030303
IV: 4142434445464748494a4b4c4d4e4f505152535455565758
Header: 633273702e6f72672f584145532d3235362d47434d
Plaintext: 584145532d3235362d47434d
Ciphertext: 986ec1832593df5443a17943
MAC: 7fd083bf3fdb41abd740a21f71eb769d
Test: Encrypt

# Empty plaintext test (authentication only)
Key: 0101010101010101010101010101010101010101010101010101010101010101
IV: 4142434445464748494a4b4c4d4e4f505152535455565758
Header: 633273702e6f72672f584145532d3235362d47434d
Plaintext:
Ciphertext:
MAC: 6ec1598d01f7a00412248e09ad7dc61d
Test: Encrypt

# Invalid MAC test (all-zeros MAC which should fail verification)
Key: 0101010101010101010101010101010101010101010101010101010101010101
IV: 4142434445464748494a4b4c4d4e4f505152535455565758
MAC: 00000000000000000000000000000000
Test: NotVerify
