bugfix: if the len of iv is not 96-bit, ghash is used to compute y0. An initialization vector IV can have any number of bits between 1 and 2^64. So it should be filled to the lower 64-bit in the last step when computing ghash.
bugfix: if the len of iv is not 96-bit, ghash is used to compute y0.
An initialization vector IV can have any number of bits between 1 and
2^64. So it should be filled to the lower 64-bit in the last step
when computing ghash.

Signed-off-by: openluopworld <9b7116ef73a0892fa84ce969a51e005553201b60@gmail.com>

NXPmicro/mbedtls,Mbed-TLS/mbedtls,NXPmicro/mbedtls,Mbed-TLS/mbedtls,ARMmbed/mbedtls,ARMmbed/mbedtls,Mbed-TLS/mbedtls,NXPmicro/mbedtls,ARMmbed/mbedtls,NXPmicro/mbedtls,Mbed-TLS/mbedtls,ARMmbed/mbedtls