While AES-SIV-CMAC allows nonces of any length, AES-GCM-SIV requires exactly 12 bytes, which is less than the unpadded minimum length of 16 used in the NTS authenticator field. These functions will be needed to support both ciphers in the NTS code.
Add a header file for Synthetic Initialization Vector (SIV) cipher mode, which will be used by NTS.