---

# После получения GLOBAL_H и FLAG_CT:
AAD_PREFIX = b"user-aad-prefix:"

# Функция, которая считает GHASH для X = SECRET_VICTIM
def test_ghash_with_X(X_bytes):
    return ghash(GLOBAL_H, AAD_PREFIX + X_bytes, FLAG_CT)

G0 = test_ghash_with_X(b"\x00" * 16)
G1 = test_ghash_with_X(b"\x00" * 15 + b"\x01")
G2 = test_ghash_with_X(b"\x00" * 15 + b"\x02")
G3 = test_ghash_with_X(b"\x00" * 15 + b"\x03")

print(f"G0 = {G0.hex()}")
print(f"G1 = {G1.hex()}")
print(f"G2 = {G2.hex()}")
print(f"G3 = {G3.hex()}")

d1 = int.from_bytes(bytes(a^b for a,b in zip(G1, G0)), "big")
d2 = int.from_bytes(bytes(a^b for a,b in zip(G2, G0)), "big")
d3 = int.from_bytes(bytes(a^b for a,b in zip(G3, G0)), "big")

print(f"G1^G0 = {d1:032x}  (ожидается 1 * H^k)")
print(f"G2^G0 = {d2:032x}  (ожидается 2 * H^k)")
print(f"G3^G0 = {d3:032x}  (ожидается 3 * H^k)")

# Проверим: d2 == gf128_mul(2, d1)? d3 == gf128_mul(3, d1)?
print(f"d2 == 2*d1: {d2 == gf128_mul(2, d1)}")
print(f"d3 == 3*d1: {d3 == gf128_mul(3, d1)}")

# Найдём k: d1 == H^k?
H = int.from_bytes(GLOBAL_H, "big")
for k in range(1, 20):
    H_k = 1
    for _ in range(k):
        H_k = gf128_mul(H_k, H)
    if H_k == d1:
        print(f"*** d1 == H^{k} ***")
        break
else:
    print(f"d1 != H^k ни для k=1..19")