GCM and CTR mode with 96 bit nonce

This reduces the nonce length to 96 bit as it is recommended for GCM. With test vectors from NIST and IETF our implementation is shown to be correct.
This closes #138.
I'd appreciate a line comment explaining the situations when a counter is needed and when not.