- We only hash up to the first 16 bytes of the AAD.
- When computing the digest during decryption, handle the case where len == trailer properly.
- trailer is always smaller than AES_BLOCK_LEN, so remove a pair of unnecessary modulus operations.
- Replace some byte-by-byte loops with memcpy() and memset() calls. In particular, zero the full block before copying a partial block into it since we do that elsewhere and it means that the memset() length is known at compile time.