diff --git a/networking/tls.c b/networking/tls.c
index 7bdd58018..85a4e21dd 100644
--- a/networking/tls.c
+++ b/networking/tls.c
@@ -867,7 +867,6 @@ static void xwrite_encrypted_aesgcm(tls_state_t *tls, unsigned size, unsigned ty
 	xorbuf_aligned_AES_BLOCK_SIZE(authtag, scratch);
 
 	memcpy(buf, authtag, sizeof(authtag));
-#undef COUNTER
 
 	/* Write out */
 	xhdr = (void*)(tls->outbuf + OUTBUF_PFX - 8 - RECHDR_LEN);
@@ -881,6 +880,7 @@ static void xwrite_encrypted_aesgcm(tls_state_t *tls, unsigned size, unsigned ty
 	dump_raw_out(">> %s\n", xhdr, size);
 	xwrite(tls->ofd, xhdr, size);
 	dbg("wrote %u bytes\n", size);
+#undef COUNTER
 }
 
 static void xwrite_encrypted(tls_state_t *tls, unsigned size, unsigned type)
diff --git a/networking/tls_aesgcm.c b/networking/tls_aesgcm.c
index 32ca40260..688df85fb 100644
--- a/networking/tls_aesgcm.c
+++ b/networking/tls_aesgcm.c
@@ -87,8 +87,8 @@ void FAST_FUNC aesgcm_GHASH(byte* h,
 )
 {
     byte x[AES_BLOCK_SIZE] ALIGNED_long;
-    byte scratch[AES_BLOCK_SIZE] ALIGNED_long;
-    word32 blocks, partial;
+//    byte scratch[AES_BLOCK_SIZE] ALIGNED_long;
+    unsigned blocks, partial;
     //was: byte* h = aes->H;
 
     //XMEMSET(x, 0, AES_BLOCK_SIZE);
@@ -133,9 +133,17 @@ void FAST_FUNC aesgcm_GHASH(byte* h,
     }
 
     /* Hash in the lengths of A and C in bits */
-    FlattenSzInBits(&scratch[0], aSz);
-    FlattenSzInBits(&scratch[8], cSz);
-    xorbuf_aligned_AES_BLOCK_SIZE(x, scratch);
+    //FlattenSzInBits(&scratch[0], aSz);
+    //FlattenSzInBits(&scratch[8], cSz);
+    //xorbuf_aligned_AES_BLOCK_SIZE(x, scratch);
+    // simpler:
+#define P32(v) ((uint32_t*)v)
+  //P32(x)[0] ^= 0;
+    P32(x)[1] ^= SWAP_BE32(aSz * 8);
+  //P32(x)[2] ^= 0;
+    P32(x)[3] ^= SWAP_BE32(cSz * 8);
+#undef P32
+
     GMULT(x, h);
 
     /* Copy the result into s. */