xcrypt 0.1.0

data/ext/libxcrypt/lib/alg-des.c

@@ -0,0 +1,269 @@
+/*
+ * FreeSec: libcrypt for NetBSD
+ *
+ * Copyright (c) 1994 David Burren
+ * All rights reserved.
+ *
+ * Adapted for FreeBSD-2.0 by Geoffrey M. Rehmet
+ *      this file should now *only* export crypt(), in order to make
+ *      binaries of libcrypt exportable from the USA
+ *
+ * Adapted for FreeBSD-4.0 by Mark R V Murray
+ *      this file should now *only* export crypt_des(), in order to make
+ *      a module that can be optionally included in libcrypt.
+ *
+ * Adapted for libxcrypt by Zack Weinberg, 2017
+ *      writable global data eliminated; type-punning eliminated;
+ *      des_init() run at build time (see des-mktables.c);
+ *      made into a libxcrypt algorithm module (see des-crypt.c);
+ *      functionality required to support the legacy encrypt() and
+ *      setkey() primitives re-exposed (see des-obsolete.c).
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the author nor the names of other contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * This is an original implementation of the DES and the crypt(3) interfaces
+ * by David Burren <davidb@werj.com.au>.
+ *
+ * An excellent reference on the underlying algorithm (and related
+ * algorithms) is:
+ *
+ *      B. Schneier, Applied Cryptography: protocols, algorithms,
+ *      and source code in C, John Wiley & Sons, 1994.
+ *
+ * Note that in that book's description of DES the lookups for the initial,
+ * pbox, and final permutations are inverted (this has been brought to the
+ * attention of the author).  A list of errata for this book has been
+ * posted to the sci.crypt newsgroup by the author and is available for FTP.
+ */
+
+#include "crypt-port.h"
+
+#if INCLUDE_descrypt || INCLUDE_bigcrypt || INCLUDE_bsdicrypt
+
+#include "alg-des.h"
+#include "byteorder.h"
+
+static const uint8_t key_shifts[16] =
+{
+  1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1
+};
+
+void
+des_set_key (struct des_ctx *restrict ctx,
+             const unsigned char key[MIN_SIZE(8)])
+{
+  uint32_t rawkey0, rawkey1, k0, k1, t0, t1;
+  int shifts, round;
+
+  rawkey0 = be32_to_cpu (&key[0]);
+  rawkey1 = be32_to_cpu (&key[4]);
+
+  /* Do key permutation and split into two 28-bit subkeys.  */
+  k0 = key_perm_maskl[0][(rawkey0 >> 25) & 0x7f]
+       | key_perm_maskl[1][(rawkey0 >> 17) & 0x7f]
+       | key_perm_maskl[2][(rawkey0 >> 9) & 0x7f]
+       | key_perm_maskl[3][(rawkey0 >> 1) & 0x7f]
+       | key_perm_maskl[4][(rawkey1 >> 25) & 0x7f]
+       | key_perm_maskl[5][(rawkey1 >> 17) & 0x7f]
+       | key_perm_maskl[6][(rawkey1 >> 9) & 0x7f]
+       | key_perm_maskl[7][(rawkey1 >> 1) & 0x7f];
+  k1 = key_perm_maskr[0][(rawkey0 >> 25) & 0x7f]
+       | key_perm_maskr[1][(rawkey0 >> 17) & 0x7f]
+       | key_perm_maskr[2][(rawkey0 >> 9) & 0x7f]
+       | key_perm_maskr[3][(rawkey0 >> 1) & 0x7f]
+       | key_perm_maskr[4][(rawkey1 >> 25) & 0x7f]
+       | key_perm_maskr[5][(rawkey1 >> 17) & 0x7f]
+       | key_perm_maskr[6][(rawkey1 >> 9) & 0x7f]
+       | key_perm_maskr[7][(rawkey1 >> 1) & 0x7f];
+
+  /* Rotate subkeys and do compression permutation.  */
+  shifts = 0;
+  for (round = 0; round < 16; round++)
+    {
+      shifts += key_shifts[round];
+
+      t0 = (k0 << shifts) | (k0 >> (28 - shifts));
+      t1 = (k1 << shifts) | (k1 >> (28 - shifts));
+
+      ctx->keysl[round] =
+        comp_maskl[0][(t0 >> 21) & 0x7f]
+        | comp_maskl[1][(t0 >> 14) & 0x7f]
+        | comp_maskl[2][(t0 >>  7) & 0x7f]
+        | comp_maskl[3][(t0 >>  0) & 0x7f]
+        | comp_maskl[4][(t1 >> 21) & 0x7f]
+        | comp_maskl[5][(t1 >> 14) & 0x7f]
+        | comp_maskl[6][(t1 >>  7) & 0x7f]
+        | comp_maskl[7][(t1 >>  0) & 0x7f];
+
+      ctx->keysr[round] =
+        comp_maskr[0][(t0 >> 21) & 0x7f]
+        | comp_maskr[1][(t0 >> 14) & 0x7f]
+        | comp_maskr[2][(t0 >>  7) & 0x7f]
+        | comp_maskr[3][(t0 >>  0) & 0x7f]
+        | comp_maskr[4][(t1 >> 21) & 0x7f]
+        | comp_maskr[5][(t1 >> 14) & 0x7f]
+        | comp_maskr[6][(t1 >>  7) & 0x7f]
+        | comp_maskr[7][(t1 >>  0) & 0x7f];
+    }
+}
+
+void
+des_set_salt (struct des_ctx *restrict ctx, uint32_t salt)
+{
+  uint32_t obit, saltbit, saltbits;
+  int i;
+  saltbits = 0L;
+  saltbit = 1;
+  obit = 0x800000;
+  for (i = 0; i < 24; i++)
+    {
+      if (salt & saltbit)
+        saltbits |= obit;
+      saltbit <<= 1;
+      obit >>= 1;
+    }
+  ctx->saltbits = saltbits;
+}
+
+void
+des_crypt_block (struct des_ctx *restrict ctx,
+                 unsigned char *out, const unsigned char *in,
+                 unsigned int count, bool decrypt)
+{
+  uint32_t l_in, r_in, l_out, r_out;
+  uint32_t l, r, *kl, *kr, *kl1, *kr1;
+  uint32_t f, r48l, r48r;
+  uint32_t saltbits = ctx->saltbits;
+  int round, rk_step;
+
+  /* Zero encryptions/decryptions doesn't make sense.  */
+  if (count == 0)
+    count = 1;
+
+  if (decrypt)
+    {
+      kl1 = ctx->keysl + 15;
+      kr1 = ctx->keysr + 15;
+      rk_step = -1;
+    }
+  else
+    {
+      kl1 = ctx->keysl;
+      kr1 = ctx->keysr;
+      rk_step = 1;
+    }
+
+  /* Read the input, which is notionally in "big-endian" format.  */
+  l_in = be32_to_cpu (in);
+  r_in = be32_to_cpu (in + 4);
+
+  /* Do initial permutation.  */
+  l = ip_maskl[0][(l_in >> 24) & 0xff]
+      | ip_maskl[1][(l_in >> 16) & 0xff]
+      | ip_maskl[2][(l_in >>  8) & 0xff]
+      | ip_maskl[3][(l_in >>  0) & 0xff]
+      | ip_maskl[4][(r_in >> 24) & 0xff]
+      | ip_maskl[5][(r_in >> 16) & 0xff]
+      | ip_maskl[6][(r_in >>  8) & 0xff]
+      | ip_maskl[7][(r_in >>  0) & 0xff];
+  r = ip_maskr[0][(l_in >> 24) & 0xff]
+      | ip_maskr[1][(l_in >> 16) & 0xff]
+      | ip_maskr[2][(l_in >>  8) & 0xff]
+      | ip_maskr[3][(l_in >>  0) & 0xff]
+      | ip_maskr[4][(r_in >> 24) & 0xff]
+      | ip_maskr[5][(r_in >> 16) & 0xff]
+      | ip_maskr[6][(r_in >>  8) & 0xff]
+      | ip_maskr[7][(r_in >>  0) & 0xff];
+
+  do
+    {
+      kl = kl1;
+      kr = kr1;
+      round = 16;
+      do
+        {
+          /* Expand R to 48 bits (simulate the E-box).  */
+          r48l = ((r & 0x00000001) << 23)
+                 | ((r & 0xf8000000) >>  9)
+                 | ((r & 0x1f800000) >> 11)
+                 | ((r & 0x01f80000) >> 13)
+                 | ((r & 0x001f8000) >> 15);
+          r48r = ((r & 0x0001f800) <<  7)
+                 | ((r & 0x00001f80) <<  5)
+                 | ((r & 0x000001f8) <<  3)
+                 | ((r & 0x0000001f) <<  1)
+                 | ((r & 0x80000000) >> 31);
+
+          /* Apply salt and permuted round key.  */
+          f = (r48l ^ r48r) & saltbits;
+          r48l ^= f ^ *kl;
+          r48r ^= f ^ *kr;
+          kl += rk_step;
+          kr += rk_step;
+
+          /* Do sbox lookups (which shrink it back to 32 bits)
+             and the pbox permutation at the same time.  */
+          f = psbox[0][m_sbox[0][r48l >> 12]]
+              | psbox[1][m_sbox[1][r48l & 0xfff]]
+              | psbox[2][m_sbox[2][r48r >> 12]]
+              | psbox[3][m_sbox[3][r48r & 0xfff]];
+
+          /* Now that we've permuted things, complete f().  */
+          f ^= l;
+          l = r;
+          r = f;
+        }
+      while (--round);
+
+      r = l;
+      l = f;
+    }
+  while (--count);
+
+  /* Do final permutation (inverse of IP).  */
+  l_out =
+    fp_maskl[0][(l >> 24) & 0xff]
+    | fp_maskl[1][(l >> 16) & 0xff]
+    | fp_maskl[2][(l >>  8) & 0xff]
+    | fp_maskl[3][(l >>  0) & 0xff]
+    | fp_maskl[4][(r >> 24) & 0xff]
+    | fp_maskl[5][(r >> 16) & 0xff]
+    | fp_maskl[6][(r >>  8) & 0xff]
+    | fp_maskl[7][(r >>  0) & 0xff];
+  r_out =
+    fp_maskr[0][(l >> 24) & 0xff]
+    | fp_maskr[1][(l >> 16) & 0xff]
+    | fp_maskr[2][(l >>  8) & 0xff]
+    | fp_maskr[3][(l >>  0) & 0xff]
+    | fp_maskr[4][(r >> 24) & 0xff]
+    | fp_maskr[5][(r >> 16) & 0xff]
+    | fp_maskr[6][(r >>  8) & 0xff]
+    | fp_maskr[7][(r >>  0) & 0xff];
+
+  cpu_to_be32 (out, l_out);
+  cpu_to_be32 (out + 4, r_out);
+}
+
+#endif

data/ext/libxcrypt/lib/alg-des.h

@@ -0,0 +1,74 @@
+/*
+ * FreeSec: libcrypt for NetBSD
+ *
+ * Copyright (c) 1994 David Burren
+ * All rights reserved.
+ *
+ * Adapted for FreeBSD-2.0 by Geoffrey M. Rehmet
+ *      this file should now *only* export crypt(), in order to make
+ *      binaries of libcrypt exportable from the USA
+ *
+ * Adapted for FreeBSD-4.0 by Mark R V Murray
+ *      this file should now *only* export crypt_des(), in order to make
+ *      a module that can be optionally included in libcrypt.
+ *
+ * Adapted for libxcrypt by Zack Weinberg, 2017
+ *      see notes in des.c
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the author nor the names of other contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * This is an original implementation of the DES and the crypt(3) interfaces
+ * by David Burren <davidb@werj.com.au>.
+ */
+
+#ifndef _CRYPT_ALG_DES_H
+#define _CRYPT_ALG_DES_H 1
+
+/* des.c */
+
+struct des_ctx
+{
+  uint32_t keysl[16];
+  uint32_t keysr[16];
+  uint32_t saltbits;
+};
+
+extern void des_set_key (struct des_ctx *restrict ctx,
+                         const unsigned char key[MIN_SIZE(8)]);
+extern void des_set_salt (struct des_ctx *restrict ctx,
+                          uint32_t salt);
+extern void des_crypt_block (struct des_ctx *restrict ctx,
+                             unsigned char *out, const unsigned char *in,
+                             unsigned int count, bool decrypt);
+
+/* des-tables.c (generated by des-mktables) */
+extern const uint8_t m_sbox[4][4096];
+extern const uint32_t ip_maskl[8][256], ip_maskr[8][256];
+extern const uint32_t fp_maskl[8][256], fp_maskr[8][256];
+extern const uint32_t key_perm_maskl[8][128], key_perm_maskr[8][128];
+extern const uint32_t comp_maskl[8][128], comp_maskr[8][128];
+extern const uint32_t psbox[4][256];
+
+#endif /* alg-des.h */

data/ext/libxcrypt/lib/alg-gost3411-2012-const.h

@@ -0,0 +1,313 @@
+/*
+ * Copyright (c) 2013, Alexey Degtyarev <alexey@renatasystems.org>.
+ * All rights reserved.
+ *
+ * Iteration constants defined in standard.
+ *
+ * $Id$
+ */
+
+static const uint512_u buffer0 = {{ 0x0ULL, 0x0ULL, 0x0ULL,
+    0x0ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x0ULL }};
+
+#ifndef __GOST3411_BIG_ENDIAN__
+static const uint512_u buffer512 = {{ 0x0000000000000200ULL,
+    0x0ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x0ULL }};
+#else
+static const uint512_u buffer512 = {{ 0x0002000000000000ULL,
+    0x0ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x0ULL, 0x0ULL }};
+#endif
+
+#ifndef __GOST3411_BIG_ENDIAN__
+static const uint512_u C[12] = {
+    {{
+         0xdd806559f2a64507ULL,
+         0x05767436cc744d23ULL,
+         0xa2422a08a460d315ULL,
+         0x4b7ce09192676901ULL,
+         0x714eb88d7585c4fcULL,
+         0x2f6a76432e45d016ULL,
+         0xebcb2f81c0657c1fULL,
+         0xb1085bda1ecadae9ULL
+    }},
+    {{
+         0xe679047021b19bb7ULL,
+         0x55dda21bd7cbcd56ULL,
+         0x5cb561c2db0aa7caULL,
+         0x9ab5176b12d69958ULL,
+         0x61d55e0f16b50131ULL,
+         0xf3feea720a232b98ULL,
+         0x4fe39d460f70b5d7ULL,
+         0x6fa3b58aa99d2f1aULL
+    }},
+    {{
+         0x991e96f50aba0ab2ULL,
+         0xc2b6f443867adb31ULL,
+         0xc1c93a376062db09ULL,
+         0xd3e20fe490359eb1ULL,
+         0xf2ea7514b1297b7bULL,
+         0x06f15e5f529c1f8bULL,
+         0x0a39fc286a3d8435ULL,
+         0xf574dcac2bce2fc7ULL
+    }},
+    {{
+         0x220cbebc84e3d12eULL,
+         0x3453eaa193e837f1ULL,
+         0xd8b71333935203beULL,
+         0xa9d72c82ed03d675ULL,
+         0x9d721cad685e353fULL,
+         0x488e857e335c3c7dULL,
+         0xf948e1a05d71e4ddULL,
+         0xef1fdfb3e81566d2ULL
+    }},
+    {{
+         0x601758fd7c6cfe57ULL,
+         0x7a56a27ea9ea63f5ULL,
+         0xdfff00b723271a16ULL,
+         0xbfcd1747253af5a3ULL,
+         0x359e35d7800fffbdULL,
+         0x7f151c1f1686104aULL,
+         0x9a3f410c6ca92363ULL,
+         0x4bea6bacad474799ULL
+    }},
+    {{
+         0xfa68407a46647d6eULL,
+         0xbf71c57236904f35ULL,
+         0x0af21f66c2bec6b6ULL,
+         0xcffaa6b71c9ab7b4ULL,
+         0x187f9ab49af08ec6ULL,
+         0x2d66c4f95142a46cULL,
+         0x6fa4c33b7a3039c0ULL,
+         0xae4faeae1d3ad3d9ULL
+    }},
+    {{
+         0x8886564d3a14d493ULL,
+         0x3517454ca23c4af3ULL,
+         0x06476983284a0504ULL,
+         0x0992abc52d822c37ULL,
+         0xd3473e33197a93c9ULL,
+         0x399ec6c7e6bf87c9ULL,
+         0x51ac86febf240954ULL,
+         0xf4c70e16eeaac5ecULL
+    }},
+    {{
+         0xa47f0dd4bf02e71eULL,
+         0x36acc2355951a8d9ULL,
+         0x69d18d2bd1a5c42fULL,
+         0xf4892bcb929b0690ULL,
+         0x89b4443b4ddbc49aULL,
+         0x4eb7f8719c36de1eULL,
+         0x03e7aa020c6e4141ULL,
+         0x9b1f5b424d93c9a7ULL
+    }},
+    {{
+         0x7261445183235adbULL,
+         0x0e38dc92cb1f2a60ULL,
+         0x7b2b8a9aa6079c54ULL,
+         0x800a440bdbb2ceb1ULL,
+         0x3cd955b7e00d0984ULL,
+         0x3a7d3a1b25894224ULL,
+         0x944c9ad8ec165fdeULL,
+         0x378f5a541631229bULL
+    }},
+    {{
+         0x74b4c7fb98459cedULL,
+         0x3698fad1153bb6c3ULL,
+         0x7a1e6c303b7652f4ULL,
+         0x9fe76702af69334bULL,
+         0x1fffe18a1b336103ULL,
+         0x8941e71cff8a78dbULL,
+         0x382ae548b2e4f3f3ULL,
+         0xabbedea680056f52ULL
+    }},
+    {{
+         0x6bcaa4cd81f32d1bULL,
+         0xdea2594ac06fd85dULL,
+         0xefbacd1d7d476e98ULL,
+         0x8a1d71efea48b9caULL,
+         0x2001802114846679ULL,
+         0xd8fa6bbbebab0761ULL,
+         0x3002c6cd635afe94ULL,
+         0x7bcd9ed0efc889fbULL
+    }},
+    {{
+         0x48bc924af11bd720ULL,
+         0xfaf417d5d9b21b99ULL,
+         0xe71da4aa88e12852ULL,
+         0x5d80ef9d1891cc86ULL,
+         0xf82012d430219f9bULL,
+         0xcda43c32bcdf1d77ULL,
+         0xd21380b00449b17aULL,
+         0x378ee767f11631baULL
+    }}
+};
+#else
+static const uint512_u C[12] = {
+    {{
+         0x0745a6f2596580ddULL,
+         0x234d74cc36747605ULL,
+         0x15d360a4082a42a2ULL,
+         0x0169679291e07c4bULL,
+         0xfcc485758db84e71ULL,
+         0x16d0452e43766a2fULL,
+         0x1f7c65c0812fcbebULL,
+         0xe9daca1eda5b08b1ULL
+    }},
+    {{
+         0xb79bb121700479e6ULL,
+         0x56cdcbd71ba2dd55ULL,
+         0xcaa70adbc261b55cULL,
+         0x5899d6126b17b59aULL,
+         0x3101b5160f5ed561ULL,
+         0x982b230a72eafef3ULL,
+         0xd7b5700f469de34fULL,
+         0x1a2f9da98ab5a36fULL
+    }},
+    {{
+         0xb20aba0af5961e99ULL,
+         0x31db7a8643f4b6c2ULL,
+         0x09db6260373ac9c1ULL,
+         0xb19e3590e40fe2d3ULL,
+         0x7b7b29b11475eaf2ULL,
+         0x8b1f9c525f5ef106ULL,
+         0x35843d6a28fc390aULL,
+         0xc72fce2bacdc74f5ULL
+    }},
+    {{
+         0x2ed1e384bcbe0c22ULL,
+         0xf137e893a1ea5334ULL,
+         0xbe0352933313b7d8ULL,
+         0x75d603ed822cd7a9ULL,
+         0x3f355e68ad1c729dULL,
+         0x7d3c5c337e858e48ULL,
+         0xdde4715da0e148f9ULL,
+         0xd26615e8b3df1fefULL
+    }},
+    {{
+         0x57fe6c7cfd581760ULL,
+         0xf563eaa97ea2567aULL,
+         0x161a2723b700ffdfULL,
+         0xa3f53a254717cdbfULL,
+         0xbdff0f80d7359e35ULL,
+         0x4a1086161f1c157fULL,
+         0x6323a96c0c413f9aULL,
+         0x994747adac6bea4bULL
+    }},
+    {{
+         0x6e7d64467a4068faULL,
+         0x354f903672c571bfULL,
+         0xb6c6bec2661ff20aULL,
+         0xb4b79a1cb7a6facfULL,
+         0xc68ef09ab49a7f18ULL,
+         0x6ca44251f9c4662dULL,
+         0xc039307a3bc3a46fULL,
+         0xd9d33a1daeae4faeULL
+    }},
+    {{
+         0x93d4143a4d568688ULL,
+         0xf34a3ca24c451735ULL,
+         0x04054a2883694706ULL,
+         0x372c822dc5ab9209ULL,
+         0xc9937a19333e47d3ULL,
+         0xc987bfe6c7c69e39ULL,
+         0x540924bffe86ac51ULL,
+         0xecc5aaee160ec7f4ULL
+    }},
+    {{
+         0x1ee702bfd40d7fa4ULL,
+         0xd9a8515935c2ac36ULL,
+         0x2fc4a5d12b8dd169ULL,
+         0x90069b92cb2b89f4ULL,
+         0x9ac4db4d3b44b489ULL,
+         0x1ede369c71f8b74eULL,
+         0x41416e0c02aae703ULL,
+         0xa7c9934d425b1f9bULL
+    }},
+    {{
+         0xdb5a238351446172ULL,
+         0x602a1fcb92dc380eULL,
+         0x549c07a69a8a2b7bULL,
+         0xb1ceb2db0b440a80ULL,
+         0x84090de0b755d93cULL,
+         0x244289251b3a7d3aULL,
+         0xde5f16ecd89a4c94ULL,
+         0x9b223116545a8f37ULL
+    }},
+    {{
+         0xed9c4598fbc7b474ULL,
+         0xc3b63b15d1fa9836ULL,
+         0xf452763b306c1e7aULL,
+         0x4b3369af0267e79fULL,
+         0x0361331b8ae1ff1fULL,
+         0xdb788aff1ce74189ULL,
+         0xf3f3e4b248e52a38ULL,
+         0x526f0580a6debeabULL
+    }},
+    {{
+         0x1b2df381cda4ca6bULL,
+         0x5dd86fc04a59a2deULL,
+         0x986e477d1dcdbaefULL,
+         0xcab948eaef711d8aULL,
+         0x7966841421800120ULL,
+         0x6107abebbb6bfad8ULL,
+         0x94fe5a63cdc60230ULL,
+         0xfb89c8efd09ecd7bULL
+    }},
+    {{
+         0x20d71bf14a92bc48ULL,
+         0x991bb2d9d517f4faULL,
+         0x5228e188aaa41de7ULL,
+         0x86cc91189def805dULL,
+         0x9b9f2130d41220f8ULL,
+         0x771ddfbc323ca4cdULL,
+         0x7ab14904b08013d2ULL,
+         0xba3116f167e78e37ULL
+    }}
+};
+#endif
+
+static const unsigned char Tau[64] = {
+    0,   8,  16,  24,  32,  40,  48,  56,
+    1,   9,  17,  25,  33,  41,  49,  57,
+    2,  10,  18,  26,  34,  42,  50,  58,
+    3,  11,  19,  27,  35,  43,  51,  59,
+    4,  12,  20,  28,  36,  44,  52,  60,
+    5,  13,  21,  29,  37,  45,  53,  61,
+    6,  14,  22,  30,  38,  46,  54,  62,
+    7,  15,  23,  31,  39,  47,  55,  63
+};
+
+static const unsigned char Pi[256] = {
+    252, 238, 221,  17, 207, 110,  49,  22,
+    251, 196, 250, 218,  35, 197,   4,  77,
+    233, 119, 240, 219, 147,  46, 153, 186,
+     23,  54, 241, 187,  20, 205,  95, 193,
+    249,  24, 101,  90, 226,  92, 239,  33,
+    129,  28,  60,  66, 139,   1, 142,  79,
+      5, 132,   2, 174, 227, 106, 143, 160,
+      6,  11, 237, 152, 127, 212, 211,  31,
+    235,  52,  44,  81, 234, 200,  72, 171,
+    242,  42, 104, 162, 253,  58, 206, 204,
+    181, 112,  14,  86,   8,  12, 118,  18,
+    191, 114,  19,  71, 156, 183,  93, 135,
+     21, 161, 150,  41,  16, 123, 154, 199,
+    243, 145, 120, 111, 157, 158, 178, 177,
+     50, 117,  25,  61, 255,  53, 138, 126,
+    109,  84, 198, 128, 195, 189,  13,  87,
+    223, 245,  36, 169,  62, 168,  67, 201,
+    215, 121, 214, 246, 124,  34, 185,   3,
+    224,  15, 236, 222, 122, 148, 176, 188,
+    220, 232,  40,  80,  78,  51,  10,  74,
+    167, 151,  96, 115,  30,   0,  98,  68,
+     26, 184,  56, 130, 100, 159,  38,  65,
+    173,  69,  70, 146,  39,  94,  85,  47,
+    140, 163, 165, 125, 105, 213, 149,  59,
+      7,  88, 179,  64, 134, 172,  29, 247,
+     48,  55, 107, 228, 136, 217, 231, 137,
+    225,  27, 131,  73,  76,  63, 248, 254,
+    141,  83, 170, 144, 202, 216, 133,  97,
+     32, 113, 103, 164,  45,  43,   9,  91,
+    203, 155,  37, 208, 190, 229, 108,  82,
+     89, 166, 116, 210, 230, 244, 180, 192,
+    209, 102, 175, 194,  57,  75,  99, 182
+};