I've heard that Galois Counter Mode (GCM) is an "online" encryption algorithm—it is not necessary to know the size of the input ahead of time. But does GCM require that all authenticated-but-not-encrypted data ("adata") be provided to the algorithm before processing the data to be encrypted?
If there is no ordering requirement, how can an implementation combine the two independently-calculated sides into a single GHASH result? My guess is that if it is possible, it involves rearranging the GHASH results into a polynomial.
I wasn't able to find anything on this with some searches on here and Google.