Don't need separate tag buffer for GCM mode: use EVP_CIPHER_CTX buf