Function aes128gcm_seal 

pub fn aes128gcm_seal(
    key: &[u8; 16],
    nonce: &[u8; 12],
    aad: &[u8],
    plaintext: &[u8],
) -> Vec<u8> 

AES-128-GCM seal: appends the 16-byte tag to the ciphertext. nonce = 12 bytes from the transform header’s Nonce field; aad = the 32-byte header tail (MsgSize..SessionId end).