Note: this is wrong. NaCl's Poly1305 doesn't use AES