"For the AEAD_AES_128_GCM algorithm, this keystream MUST be generated in
the manner defined in [RFC6904], using the AES Counter Mode (AES-CM)
transform. For the AEAD_AES_256_GCM algorithm, the keystream MUST be
generated in the manner defined for the AES_256_CM transform. The
originator must perform any required header extension encryption before
the AEAD algorithm is invoked."