Reduced 16-round Magma cipher is used instead of 32 one.
Authenticating data does not have neither padding, nor
length specifying, so MAC(0xDEAD) = MAC(0xDEAD00).
Specified counter (CTR) mode increments counters with predefined
constants for 32-bit halves of the block. This differs from simpler
counter mode implementations.