I want to implement AES-128-GCM in assembler using Intel AES-NI instructions. I have found reference code in the Intel AES-NI Whitepaper but I don't see code for the GCM mode there (or indeed any use of the PCLMULQDQ instruction). Do I miss something in this document? Or could somebody point me to another similarly clean and simple implementation in assembler with AES-NI instructions that uses GCM mode?
I am hopeful that the implementation will be pretty straightforward given a good reference implementation and also good reference benchmarks for cycles per byte. The main reason I am reimplementing this is as an exercise in using an unusual assembler (DynASM).