aegis-aead 0.2.1 → 0.2.3

package/dist/aes-bs.js

@@ -2,6 +2,16 @@
  * Bitsliced AES implementation using 32-bit integers.
  * Processes 8 AES blocks simultaneously for constant-time operation.
  * Based on the barrel-shiftrows representation by Adomnicai and Peyrin.
+ *
+ * The packed layout matches the reference C implementation: the state words
+ * are permuted so that bit-plane k of byte group g lives in word 4k + g.
+ * The four group lanes of each bit-plane are therefore adjacent, ShiftRows
+ * and MixColumns work on isomorphic quads, and an AES round needs no
+ * per-round transposes.
+ *
+ * The hot-path functions (AEGIS rounds, constant-input packing, keystream
+ * extraction) are fully unrolled over local variables and generated by
+ * scripts/gen-aes-bs.ts.
  */
 /**
  * Creates a new bitsliced state for 8 AES blocks.
@@ -20,380 +30,2312 @@ export function createAesBlock() {
  * Swaps bits at positions n between a and b using a mask.
  */
 function swapmove(st, aIdx, bIdx, mask, n) {
-    const tmp = ((st[bIdx] ^ (st[aIdx] >>> n)) & mask) >>> 0;
-    st[bIdx] = (st[bIdx] ^ tmp) >>> 0;
-    st[aIdx] = (st[aIdx] ^ ((tmp << n) >>> 0)) >>> 0;
+    const tmp = (st[bIdx] ^ (st[aIdx] >>> n)) & mask;
+    st[bIdx] = st[bIdx] ^ tmp;
+    st[aIdx] = st[aIdx] ^ (tmp << n);
 }
 /**
- * 32-bit left rotation.
- */
-function rotl32(x, b) {
-    return ((x << b) | (x >>> (32 - b))) >>> 0;
-}
-/**
- * S-box implementation using bitsliced logic gates.
- * Maximov & Ekdahl circuit.
+ * Computes the index of a block word in the unpacked state array.
+ * @param block - Block index (0-7)
+ * @param word - Word index (0-3)
  */
-function sbox(st, offset) {
-    let u0 = st[offset];
-    let u1 = st[offset + 1];
-    let u2 = st[offset + 2];
-    let u3 = st[offset + 3];
-    let u4 = st[offset + 4];
-    let u5 = st[offset + 5];
-    let u6 = st[offset + 6];
-    let u7 = st[offset + 7];
-    const z24 = (u3 ^ u4) >>> 0;
-    const q17 = (u1 ^ u7) >>> 0;
-    const q16 = (u5 ^ q17) >>> 0;
-    const q0 = (z24 ^ q16) >>> 0;
-    const q7 = (z24 ^ u1 ^ u6) >>> 0;
-    const q2 = (u2 ^ q0) >>> 0;
-    const q1 = (q7 ^ q2) >>> 0;
-    const q3 = (u0 ^ q7) >>> 0;
-    const q4 = (u0 ^ q2) >>> 0;
-    const q5 = (u1 ^ q4) >>> 0;
-    const q6 = (u2 ^ u3) >>> 0;
-    const q10 = (q6 ^ q7) >>> 0;
-    const q8 = (u0 ^ q10) >>> 0;
-    const q9 = (q8 ^ q2) >>> 0;
-    const q12 = (z24 ^ q17) >>> 0;
-    const q15 = (u7 ^ q4) >>> 0;
-    const q13 = (z24 ^ q15) >>> 0;
-    const q14 = (q15 ^ q0) >>> 0;
-    const q11 = u5;
-    // NAND(x, y) = ~(x & y)
-    // NOR(x, y) = ~(x | y)
-    // XNOR(x, y) = ~(x ^ y)
-    // MUX(s, x, y) = (x & s) | (y & ~s)
-    const nand = (x, y) => ~(x & y) >>> 0;
-    const nor = (x, y) => ~(x | y) >>> 0;
-    const xnor = (x, y) => ~(x ^ y) >>> 0;
-    const mux = (s, x, y) => (((x & s) >>> 0) | ((y & ~s) >>> 0)) >>> 0;
-    const t20 = nand(q6, q12);
-    const t21 = nand(q3, q14);
-    const t22 = nand(q1, q16);
-    const x0 = (nor(q3, q14) ^ nand(q0, q7) ^ (t20 ^ t22)) >>> 0;
-    const x1 = (nor(q4, q13) ^ nand(q10, q11) ^ (t21 ^ t20)) >>> 0;
-    const x2 = (nor(q2, q17) ^ nand(q5, q9) ^ (t21 ^ t22)) >>> 0;
-    const x3 = (nor(q8, q15) ^ nand(q2, q17) ^ (t21 ^ nand(q4, q13))) >>> 0;
-    const t2 = xnor(nand(x0, x2), nor(x1, x3));
-    const y0 = mux(x2, t2, x3);
-    const y2 = mux(x0, t2, x1);
-    const y1 = mux(t2, x3, mux(x1, x2, 0xffffffff));
-    const y3 = mux(t2, x1, mux(x3, x0, 0xffffffff));
-    const y02 = (y2 ^ y0) >>> 0;
-    const y13 = (y3 ^ y1) >>> 0;
-    const y23 = (y3 ^ y2) >>> 0;
-    const y01 = (y1 ^ y0) >>> 0;
-    const y00 = (y02 ^ y13) >>> 0;
-    const n0 = nand(y01, q11);
-    const n1 = nand(y0, q12);
-    const n2 = nand(y1, q0);
-    const n3 = nand(y23, q17);
-    const n4 = nand(y2, q5);
-    const n5 = nand(y3, q15);
-    const n6 = nand(y13, q14);
-    const n7 = nand(y00, q16);
-    const n8 = nand(y02, q13);
-    const n9 = nand(y01, q7);
-    const n10 = nand(y0, q10);
-    const n11 = nand(y1, q6);
-    const n12 = nand(y23, q2);
-    const n13 = nand(y2, q9);
-    const n14 = nand(y3, q8);
-    const n15 = nand(y13, q3);
-    const n16 = nand(y00, q1);
-    const n17 = nand(y02, q4);
-    const h1 = (n4 ^ n1 ^ n5) >>> 0;
-    u2 = xnor(n2, h1);
-    const h2 = (n9 ^ n15) >>> 0;
-    u6 = xnor(h2, (n11 ^ n17) >>> 0);
-    const h4 = (n11 ^ n14) >>> 0;
-    const h5 = (n9 ^ n12) >>> 0;
-    u5 = (h4 ^ h5) >>> 0;
-    const h7 = (u2 ^ u6) >>> 0;
-    const h8 = (n10 ^ h7) >>> 0;
-    u7 = xnor((n16 ^ h2) >>> 0, h8);
-    const h9 = (n8 ^ h1) >>> 0;
-    const h10 = (n13 ^ h8) >>> 0;
-    u3 = (h5 ^ h10) >>> 0;
-    const h13 = (h4 ^ n7 ^ h9 ^ h10) >>> 0;
-    u4 = (n1 ^ h13) >>> 0;
-    const h14 = xnor(n0, u7);
-    u1 = xnor(n6, (h7 ^ h9 ^ h14) >>> 0);
-    u0 = (h13 ^ n3 ^ n4 ^ h14) >>> 0;
-    st[offset] = u0;
-    st[offset + 1] = u1;
-    st[offset + 2] = u2;
-    st[offset + 3] = u3;
-    st[offset + 4] = u4;
-    st[offset + 5] = u5;
-    st[offset + 6] = u6;
-    st[offset + 7] = u7;
+export function wordIdx(block, word) {
+    return block * 4 + word;
 }
 /**
- * Apply S-box to all 4 byte positions.
+ * Pack 8 AES blocks into bitsliced representation.
  */
-function sboxes(st) {
+export function pack(st) {
+    for (let i = 0; i < 32; i += 4) {
+        swapmove(st, i, i + 1, 0x00ff00ff, 8);
+        swapmove(st, i + 2, i + 3, 0x00ff00ff, 8);
+        swapmove(st, i, i + 2, 0x0000ffff, 16);
+        swapmove(st, i + 1, i + 3, 0x0000ffff, 16);
+    }
     for (let i = 0; i < 4; i++) {
-        sbox(st, 8 * i);
+        swapmove(st, i + 4, i, 0x55555555, 1);
+        swapmove(st, i + 12, i + 8, 0x55555555, 1);
+        swapmove(st, i + 20, i + 16, 0x55555555, 1);
+        swapmove(st, i + 28, i + 24, 0x55555555, 1);
+        swapmove(st, i + 8, i, 0x33333333, 2);
+        swapmove(st, i + 12, i + 4, 0x33333333, 2);
+        swapmove(st, i + 24, i + 16, 0x33333333, 2);
+        swapmove(st, i + 28, i + 20, 0x33333333, 2);
+        swapmove(st, i + 16, i, 0x0f0f0f0f, 4);
+        swapmove(st, i + 20, i + 4, 0x0f0f0f0f, 4);
+        swapmove(st, i + 24, i + 8, 0x0f0f0f0f, 4);
+        swapmove(st, i + 28, i + 12, 0x0f0f0f0f, 4);
     }
 }
 /**
- * ShiftRows operation in bitsliced form.
+ * Unpack bitsliced representation to 8 AES blocks.
  */
-function shiftrows(st) {
-    for (let i = 8; i < 16; i++) {
-        st[i] = rotl32(st[i], 24);
-    }
-    for (let i = 16; i < 24; i++) {
-        st[i] = rotl32(st[i], 16);
+export function unpack(st) {
+    for (let i = 0; i < 4; i++) {
+        swapmove(st, i + 4, i, 0x55555555, 1);
+        swapmove(st, i + 12, i + 8, 0x55555555, 1);
+        swapmove(st, i + 20, i + 16, 0x55555555, 1);
+        swapmove(st, i + 28, i + 24, 0x55555555, 1);
+        swapmove(st, i + 8, i, 0x33333333, 2);
+        swapmove(st, i + 12, i + 4, 0x33333333, 2);
+        swapmove(st, i + 24, i + 16, 0x33333333, 2);
+        swapmove(st, i + 28, i + 20, 0x33333333, 2);
+        swapmove(st, i + 16, i, 0x0f0f0f0f, 4);
+        swapmove(st, i + 20, i + 4, 0x0f0f0f0f, 4);
+        swapmove(st, i + 24, i + 8, 0x0f0f0f0f, 4);
+        swapmove(st, i + 28, i + 12, 0x0f0f0f0f, 4);
     }
-    for (let i = 24; i < 32; i++) {
-        st[i] = rotl32(st[i], 8);
+    for (let i = 0; i < 32; i += 4) {
+        swapmove(st, i, i + 2, 0x0000ffff, 16);
+        swapmove(st, i + 1, i + 3, 0x0000ffff, 16);
+        swapmove(st, i, i + 1, 0x00ff00ff, 8);
+        swapmove(st, i + 2, i + 3, 0x00ff00ff, 8);
     }
 }
 /**
- * MixColumns operation in bitsliced form.
- */
-function mixcolumns(st) {
-    const t2_0 = (st[0] ^ st[8]) >>> 0;
-    const t2_1 = (st[8] ^ st[16]) >>> 0;
-    const t2_2 = (st[16] ^ st[24]) >>> 0;
-    const t2_3 = (st[24] ^ st[0]) >>> 0;
-    let t0_0 = (st[7] ^ st[15]) >>> 0;
-    let t0_1 = (st[15] ^ st[23]) >>> 0;
-    let t0_2 = (st[23] ^ st[31]) >>> 0;
-    let t0_3 = (st[31] ^ st[7]) >>> 0;
-    let t = st[7];
-    st[7] = (t2_0 ^ t0_2 ^ st[15]) >>> 0;
-    st[15] = (t2_1 ^ t0_2 ^ t) >>> 0;
-    t = st[23];
-    st[23] = (t2_2 ^ t0_0 ^ st[31]) >>> 0;
-    st[31] = (t2_3 ^ t0_0 ^ t) >>> 0;
-    let t1_0 = (st[6] ^ st[14]) >>> 0;
-    let t1_1 = (st[14] ^ st[22]) >>> 0;
-    let t1_2 = (st[22] ^ st[30]) >>> 0;
-    let t1_3 = (st[30] ^ st[6]) >>> 0;
-    t = st[6];
-    let t_bis = st[14];
-    st[6] = (t0_0 ^ t2_0 ^ st[14] ^ t1_2) >>> 0;
-    st[14] = (t0_1 ^ t2_1 ^ t1_2 ^ t) >>> 0;
-    t = st[22];
-    st[22] = (t0_2 ^ t2_2 ^ t1_3 ^ t_bis) >>> 0;
-    st[30] = (t0_3 ^ t2_3 ^ t1_0 ^ t) >>> 0;
-    t0_0 = (st[5] ^ st[13]) >>> 0;
-    t0_1 = (st[13] ^ st[21]) >>> 0;
-    t0_2 = (st[21] ^ st[29]) >>> 0;
-    t0_3 = (st[29] ^ st[5]) >>> 0;
-    t = st[5];
-    t_bis = st[13];
-    st[5] = (t1_0 ^ t0_1 ^ st[29]) >>> 0;
-    st[13] = (t1_1 ^ t0_2 ^ t) >>> 0;
-    t = st[21];
-    st[21] = (t1_2 ^ t0_3 ^ t_bis) >>> 0;
-    st[29] = (t1_3 ^ t0_0 ^ t) >>> 0;
-    t1_0 = (st[4] ^ st[12]) >>> 0;
-    t1_1 = (st[12] ^ st[20]) >>> 0;
-    t1_2 = (st[20] ^ st[28]) >>> 0;
-    t1_3 = (st[28] ^ st[4]) >>> 0;
-    t = st[4];
-    t_bis = st[12];
-    st[4] = (t0_0 ^ t2_0 ^ t1_1 ^ st[28]) >>> 0;
-    st[12] = (t0_1 ^ t2_1 ^ t1_2 ^ t) >>> 0;
-    t = st[20];
-    st[20] = (t0_2 ^ t2_2 ^ t1_3 ^ t_bis) >>> 0;
-    st[28] = (t0_3 ^ t2_3 ^ t1_0 ^ t) >>> 0;
-    t0_0 = (st[3] ^ st[11]) >>> 0;
-    t0_1 = (st[11] ^ st[19]) >>> 0;
-    t0_2 = (st[19] ^ st[27]) >>> 0;
-    t0_3 = (st[27] ^ st[3]) >>> 0;
-    t = st[3];
-    t_bis = st[11];
-    st[3] = (t1_0 ^ t2_0 ^ t0_1 ^ st[27]) >>> 0;
-    st[11] = (t1_1 ^ t2_1 ^ t0_2 ^ t) >>> 0;
-    t = st[19];
-    st[19] = (t1_2 ^ t2_2 ^ t0_3 ^ t_bis) >>> 0;
-    st[27] = (t1_3 ^ t2_3 ^ t0_0 ^ t) >>> 0;
-    t1_0 = (st[2] ^ st[10]) >>> 0;
-    t1_1 = (st[10] ^ st[18]) >>> 0;
-    t1_2 = (st[18] ^ st[26]) >>> 0;
-    t1_3 = (st[26] ^ st[2]) >>> 0;
-    t = st[2];
-    t_bis = st[10];
-    st[2] = (t0_0 ^ t1_1 ^ st[26]) >>> 0;
-    st[10] = (t0_1 ^ t1_2 ^ t) >>> 0;
-    t = st[18];
-    st[18] = (t0_2 ^ t1_3 ^ t_bis) >>> 0;
-    st[26] = (t0_3 ^ t1_0 ^ t) >>> 0;
-    t0_0 = (st[1] ^ st[9]) >>> 0;
-    t0_1 = (st[9] ^ st[17]) >>> 0;
-    t0_2 = (st[17] ^ st[25]) >>> 0;
-    t0_3 = (st[25] ^ st[1]) >>> 0;
-    t = st[1];
-    t_bis = st[9];
-    st[1] = (t1_0 ^ t0_1 ^ st[25]) >>> 0;
-    st[9] = (t1_1 ^ t0_2 ^ t) >>> 0;
-    t = st[17];
-    st[17] = (t1_2 ^ t0_3 ^ t_bis) >>> 0;
-    st[25] = (t1_3 ^ t0_0 ^ t) >>> 0;
-    t = st[0];
-    t_bis = st[8];
-    st[0] = (t0_0 ^ t2_1 ^ st[24]) >>> 0;
-    st[8] = (t0_1 ^ t2_2 ^ t) >>> 0;
-    t = st[16];
-    st[16] = (t0_2 ^ t2_3 ^ t_bis) >>> 0;
-    st[24] = (t0_3 ^ t2_0 ^ t) >>> 0;
-}
-/**
- * Complete AES round (SubBytes + ShiftRows + MixColumns).
- * Note: AddRoundKey is handled separately in AEGIS.
+ * Put a single AES block into the unpacked state at the given block position.
  */
-export function aesRound(st) {
-    sboxes(st);
-    shiftrows(st);
-    mixcolumns(st);
-}
-/**
- * Pack 8 AES blocks into bitsliced representation.
- */
-export function pack(st) {
-    for (let i = 0; i < 8; i++) {
-        swapmove(st, i, i + 8, 0x00ff00ff, 8);
-        swapmove(st, i + 16, i + 24, 0x00ff00ff, 8);
-    }
-    for (let i = 0; i < 16; i++) {
-        swapmove(st, i, i + 16, 0x0000ffff, 16);
-    }
-    for (let i = 0; i < 32; i += 8) {
-        swapmove(st, i + 1, i, 0x55555555, 1);
-        swapmove(st, i + 3, i + 2, 0x55555555, 1);
-        swapmove(st, i + 5, i + 4, 0x55555555, 1);
-        swapmove(st, i + 7, i + 6, 0x55555555, 1);
-        swapmove(st, i + 2, i, 0x33333333, 2);
-        swapmove(st, i + 3, i + 1, 0x33333333, 2);
-        swapmove(st, i + 6, i + 4, 0x33333333, 2);
-        swapmove(st, i + 7, i + 5, 0x33333333, 2);
-        swapmove(st, i + 4, i, 0x0f0f0f0f, 4);
-        swapmove(st, i + 5, i + 1, 0x0f0f0f0f, 4);
-        swapmove(st, i + 6, i + 2, 0x0f0f0f0f, 4);
-        swapmove(st, i + 7, i + 3, 0x0f0f0f0f, 4);
-    }
+export function blocksPut(st, s, block) {
+    st[block * 4] = s[0];
+    st[block * 4 + 1] = s[1];
+    st[block * 4 + 2] = s[2];
+    st[block * 4 + 3] = s[3];
 }
 /**
- * Unpack bitsliced representation to 8 AES blocks.
+ * Load 16 bytes at the given offset into an AES block (little-endian).
  */
-export function unpack(st) {
-    for (let i = 0; i < 32; i += 8) {
-        swapmove(st, i + 1, i, 0x55555555, 1);
-        swapmove(st, i + 3, i + 2, 0x55555555, 1);
-        swapmove(st, i + 5, i + 4, 0x55555555, 1);
-        swapmove(st, i + 7, i + 6, 0x55555555, 1);
-        swapmove(st, i + 2, i, 0x33333333, 2);
-        swapmove(st, i + 3, i + 1, 0x33333333, 2);
-        swapmove(st, i + 6, i + 4, 0x33333333, 2);
-        swapmove(st, i + 7, i + 5, 0x33333333, 2);
-        swapmove(st, i + 4, i, 0x0f0f0f0f, 4);
-        swapmove(st, i + 5, i + 1, 0x0f0f0f0f, 4);
-        swapmove(st, i + 6, i + 2, 0x0f0f0f0f, 4);
-        swapmove(st, i + 7, i + 3, 0x0f0f0f0f, 4);
-    }
-    for (let i = 0; i < 16; i++) {
-        swapmove(st, i, i + 16, 0x0000ffff, 16);
-    }
-    for (let i = 0; i < 8; i++) {
-        swapmove(st, i, i + 8, 0x00ff00ff, 8);
-        swapmove(st, i + 16, i + 24, 0x00ff00ff, 8);
+export function blockFromBytes(out, src, off = 0) {
+    for (let i = 0; i < 4; i++) {
+        const o = off + i * 4;
+        out[i] =
+            src[o] | (src[o + 1] << 8) | (src[o + 2] << 16) | (src[o + 3] << 24);
     }
 }
 /**
- * Pack only blocks 0 and 4 (used for constant inputs in AEGIS-128L).
+ * Store an AES block as 16 bytes at the given offset (little-endian).
  */
-export function pack04(st) {
-    swapmove(st, 0, 0 + 8, 0x00ff00ff, 8);
-    swapmove(st, 0 + 16, 0 + 24, 0x00ff00ff, 8);
-    swapmove(st, 4, 4 + 8, 0x00ff00ff, 8);
-    swapmove(st, 4 + 16, 4 + 24, 0x00ff00ff, 8);
-    swapmove(st, 0, 0 + 16, 0x0000ffff, 16);
-    swapmove(st, 4, 4 + 16, 0x0000ffff, 16);
-    swapmove(st, 8, 8 + 16, 0x0000ffff, 16);
-    swapmove(st, 12, 12 + 16, 0x0000ffff, 16);
-    for (let i = 0; i < 32; i += 8) {
-        swapmove(st, i + 1, i, 0x55555555, 1);
-        swapmove(st, i + 5, i + 4, 0x55555555, 1);
-        swapmove(st, i + 2, i, 0x33333333, 2);
-        swapmove(st, i + 3, i + 1, 0x33333333, 2);
-        swapmove(st, i + 6, i + 4, 0x33333333, 2);
-        swapmove(st, i + 7, i + 5, 0x33333333, 2);
-        swapmove(st, i + 4, i, 0x0f0f0f0f, 4);
-        swapmove(st, i + 5, i + 1, 0x0f0f0f0f, 4);
-        swapmove(st, i + 6, i + 2, 0x0f0f0f0f, 4);
-        swapmove(st, i + 7, i + 3, 0x0f0f0f0f, 4);
+export function blockToBytes(out, src, off = 0) {
+    for (let i = 0; i < 4; i++) {
+        const w = src[i];
+        const o = off + i * 4;
+        out[o] = w;
+        out[o + 1] = w >>> 8;
+        out[o + 2] = w >>> 16;
+        out[o + 3] = w >>> 24;
     }
 }
 /**
- * Computes the index into the bitsliced state array.
- * @param block - Block index (0-7)
- * @param word - Word index (0-3)
+ * XOR two AES blocks: out = a ^ b
  */
-export function wordIdx(block, word) {
-    return block + word * 8;
+export function blockXor(out, a, b) {
+    out[0] = a[0] ^ b[0];
+    out[1] = a[1] ^ b[1];
+    out[2] = a[2] ^ b[2];
+    out[3] = a[3] ^ b[3];
 }
+// ---------------------------------------------------------------------------
+// ---------------------------------------------------------------------------
+// Generated code below: produced by scripts/gen-aes-bs.ts, do not edit by hand.
+// ---------------------------------------------------------------------------
 /**
- * Rotate all blocks right by 1 position (for AEGIS state rotation).
- * Performs (st[i] & 0xfefefefe) >> 1 | (st[i] & 0x01010101) << 7
+ * Fused AEGIS-128L update round on the packed state:
+ * st = st ^ rotr8(AESRound(st)) ^ ci, where rotr8 rotates the 8 block lanes.
  */
-export function blocksRotr(st) {
-    for (let i = 0; i < 32; i++) {
-        st[i] =
-            (((st[i] & 0xfefefefe) >>> 1) | ((st[i] & 0x01010101) << 7)) >>> 0;
-    }
+export function aegisRound128(st, ci) {
+    const u0_0 = st[0];
+    const u1_0 = st[4];
+    const u2_0 = st[8];
+    const u3_0 = st[12];
+    const u4_0 = st[16];
+    const u5_0 = st[20];
+    const u6_0 = st[24];
+    const u7_0 = st[28];
+    const z24_0 = u3_0 ^ u4_0;
+    const q17_0 = u1_0 ^ u7_0;
+    const q16_0 = u5_0 ^ q17_0;
+    const q0_0 = z24_0 ^ q16_0;
+    const q7_0 = z24_0 ^ u1_0 ^ u6_0;
+    const q2_0 = u2_0 ^ q0_0;
+    const q1_0 = q7_0 ^ q2_0;
+    const q3_0 = u0_0 ^ q7_0;
+    const q4_0 = u0_0 ^ q2_0;
+    const q5_0 = u1_0 ^ q4_0;
+    const q6_0 = u2_0 ^ u3_0;
+    const q10_0 = q6_0 ^ q7_0;
+    const q8_0 = u0_0 ^ q10_0;
+    const q9_0 = q8_0 ^ q2_0;
+    const q12_0 = z24_0 ^ q17_0;
+    const q15_0 = u7_0 ^ q4_0;
+    const m02_0 = u0_0 ^ u2_0;
+    const m15_0 = u1_0 ^ u5_0;
+    const q13_0 = m02_0 ^ m15_0;
+    const q14_0 = m02_0 ^ u7_0;
+    const q11_0 = u5_0;
+    const t20_0 = q6_0 & q12_0;
+    const t21_0 = q3_0 & q14_0;
+    const t22_0 = q1_0 & q16_0;
+    const t23_0 = q2_0 & q17_0;
+    const x0_0 = (q3_0 | q14_0) ^ (q0_0 & q7_0) ^ (t20_0 ^ t22_0);
+    const x1_0 = (q4_0 | q13_0) ^ (q10_0 & q11_0) ^ (t21_0 ^ t20_0);
+    const x2_0 = (q2_0 | q17_0) ^ (q5_0 & q9_0) ^ (t21_0 ^ t22_0);
+    const x3_0 = (q8_0 | q15_0) ^ t23_0 ^ (t21_0 ^ (q4_0 & q13_0));
+    const va_0 = x1_0 & ~x3_0;
+    const vb_0 = x0_0 & ~x3_0;
+    const vc_0 = x3_0 & ~x1_0;
+    const vd_0 = x2_0 & ~x1_0;
+    const ve_0 = x0_0 ^ va_0;
+    const y0_0 = x3_0 ^ (x2_0 & ~ve_0);
+    const vf_0 = x1_0 ^ vb_0;
+    const y1_0 = vc_0 ^ (x2_0 & vf_0);
+    const vg_0 = x2_0 ^ vc_0;
+    const y2_0 = x1_0 ^ (x0_0 & ~vg_0);
+    const vh_0 = x3_0 ^ vd_0;
+    const y3_0 = va_0 ^ (x0_0 & vh_0);
+    const y02_0 = y2_0 ^ y0_0;
+    const y13_0 = y3_0 ^ y1_0;
+    const y23_0 = y3_0 ^ y2_0;
+    const y01_0 = y1_0 ^ y0_0;
+    const y00_0 = y02_0 ^ y13_0;
+    const a0_0 = y01_0 & q11_0;
+    const a1_0 = y0_0 & q12_0;
+    const a2_0 = y1_0 & q0_0;
+    const a3_0 = y23_0 & q17_0;
+    const a4_0 = y2_0 & q5_0;
+    const a5_0 = y3_0 & q15_0;
+    const a6_0 = y13_0 & q14_0;
+    const a7_0 = y00_0 & q16_0;
+    const a8_0 = y02_0 & q13_0;
+    const a9_0 = y01_0 & q7_0;
+    const a10_0 = y0_0 & q10_0;
+    const a11_0 = y1_0 & q6_0;
+    const a12_0 = y23_0 & q2_0;
+    const a13_0 = y2_0 & q9_0;
+    const a14_0 = y3_0 & q8_0;
+    const a15_0 = y13_0 & q3_0;
+    const a16_0 = y00_0 & q1_0;
+    const a17_0 = y02_0 & q4_0;
+    const r0_0 = a1_0 ^ a5_0;
+    const r1_0 = a9_0 ^ a15_0;
+    const r2_0 = a4_0 ^ r0_0;
+    const r3_0 = a2_0 ^ a10_0;
+    const r4_0 = a11_0 ^ a17_0;
+    const r5_0 = a8_0 ^ r1_0;
+    const r6_0 = a0_0 ^ a16_0;
+    const r7_0 = a7_0 ^ a13_0;
+    const r8_0 = a11_0 ^ a14_0;
+    const r9_0 = r3_0 ^ r4_0;
+    const r10_0 = r5_0 ^ r6_0;
+    const r11_0 = r2_0 ^ r9_0;
+    const r12_0 = a3_0 ^ r0_0;
+    const r13_0 = r7_0 ^ r8_0;
+    const r14_0 = r12_0 ^ r13_0;
+    const o0_0 = r10_0 ^ r14_0;
+    const r15_0 = a6_0 ^ a10_0;
+    const r16_0 = r15_0 ^ r2_0;
+    const o1_0 = ~(r10_0 ^ r16_0);
+    const o2_0 = ~(a2_0 ^ r2_0);
+    const r17_0 = a12_0 ^ a13_0;
+    const r18_0 = a15_0 ^ r17_0;
+    const o3_0 = r18_0 ^ r11_0;
+    const r19_0 = a1_0 ^ a14_0;
+    const r20_0 = a17_0 ^ r3_0;
+    const r21_0 = r7_0 ^ r19_0;
+    const r22_0 = r5_0 ^ r20_0;
+    const o4_0 = r21_0 ^ r22_0;
+    const r23_0 = a9_0 ^ a12_0;
+    const o5_0 = r8_0 ^ r23_0;
+    const o6_0 = ~(r1_0 ^ r4_0);
+    const o7_0 = ~(a16_0 ^ r11_0);
+    const u0_1 = st[1];
+    const u1_1 = st[5];
+    const u2_1 = st[9];
+    const u3_1 = st[13];
+    const u4_1 = st[17];
+    const u5_1 = st[21];
+    const u6_1 = st[25];
+    const u7_1 = st[29];
+    const z24_1 = u3_1 ^ u4_1;
+    const q17_1 = u1_1 ^ u7_1;
+    const q16_1 = u5_1 ^ q17_1;
+    const q0_1 = z24_1 ^ q16_1;
+    const q7_1 = z24_1 ^ u1_1 ^ u6_1;
+    const q2_1 = u2_1 ^ q0_1;
+    const q1_1 = q7_1 ^ q2_1;
+    const q3_1 = u0_1 ^ q7_1;
+    const q4_1 = u0_1 ^ q2_1;
+    const q5_1 = u1_1 ^ q4_1;
+    const q6_1 = u2_1 ^ u3_1;
+    const q10_1 = q6_1 ^ q7_1;
+    const q8_1 = u0_1 ^ q10_1;
+    const q9_1 = q8_1 ^ q2_1;
+    const q12_1 = z24_1 ^ q17_1;
+    const q15_1 = u7_1 ^ q4_1;
+    const m02_1 = u0_1 ^ u2_1;
+    const m15_1 = u1_1 ^ u5_1;
+    const q13_1 = m02_1 ^ m15_1;
+    const q14_1 = m02_1 ^ u7_1;
+    const q11_1 = u5_1;
+    const t20_1 = q6_1 & q12_1;
+    const t21_1 = q3_1 & q14_1;
+    const t22_1 = q1_1 & q16_1;
+    const t23_1 = q2_1 & q17_1;
+    const x0_1 = (q3_1 | q14_1) ^ (q0_1 & q7_1) ^ (t20_1 ^ t22_1);
+    const x1_1 = (q4_1 | q13_1) ^ (q10_1 & q11_1) ^ (t21_1 ^ t20_1);
+    const x2_1 = (q2_1 | q17_1) ^ (q5_1 & q9_1) ^ (t21_1 ^ t22_1);
+    const x3_1 = (q8_1 | q15_1) ^ t23_1 ^ (t21_1 ^ (q4_1 & q13_1));
+    const va_1 = x1_1 & ~x3_1;
+    const vb_1 = x0_1 & ~x3_1;
+    const vc_1 = x3_1 & ~x1_1;
+    const vd_1 = x2_1 & ~x1_1;
+    const ve_1 = x0_1 ^ va_1;
+    const y0_1 = x3_1 ^ (x2_1 & ~ve_1);
+    const vf_1 = x1_1 ^ vb_1;
+    const y1_1 = vc_1 ^ (x2_1 & vf_1);
+    const vg_1 = x2_1 ^ vc_1;
+    const y2_1 = x1_1 ^ (x0_1 & ~vg_1);
+    const vh_1 = x3_1 ^ vd_1;
+    const y3_1 = va_1 ^ (x0_1 & vh_1);
+    const y02_1 = y2_1 ^ y0_1;
+    const y13_1 = y3_1 ^ y1_1;
+    const y23_1 = y3_1 ^ y2_1;
+    const y01_1 = y1_1 ^ y0_1;
+    const y00_1 = y02_1 ^ y13_1;
+    const a0_1 = y01_1 & q11_1;
+    const a1_1 = y0_1 & q12_1;
+    const a2_1 = y1_1 & q0_1;
+    const a3_1 = y23_1 & q17_1;
+    const a4_1 = y2_1 & q5_1;
+    const a5_1 = y3_1 & q15_1;
+    const a6_1 = y13_1 & q14_1;
+    const a7_1 = y00_1 & q16_1;
+    const a8_1 = y02_1 & q13_1;
+    const a9_1 = y01_1 & q7_1;
+    const a10_1 = y0_1 & q10_1;
+    const a11_1 = y1_1 & q6_1;
+    const a12_1 = y23_1 & q2_1;
+    const a13_1 = y2_1 & q9_1;
+    const a14_1 = y3_1 & q8_1;
+    const a15_1 = y13_1 & q3_1;
+    const a16_1 = y00_1 & q1_1;
+    const a17_1 = y02_1 & q4_1;
+    const r0_1 = a1_1 ^ a5_1;
+    const r1_1 = a9_1 ^ a15_1;
+    const r2_1 = a4_1 ^ r0_1;
+    const r3_1 = a2_1 ^ a10_1;
+    const r4_1 = a11_1 ^ a17_1;
+    const r5_1 = a8_1 ^ r1_1;
+    const r6_1 = a0_1 ^ a16_1;
+    const r7_1 = a7_1 ^ a13_1;
+    const r8_1 = a11_1 ^ a14_1;
+    const r9_1 = r3_1 ^ r4_1;
+    const r10_1 = r5_1 ^ r6_1;
+    const r11_1 = r2_1 ^ r9_1;
+    const r12_1 = a3_1 ^ r0_1;
+    const r13_1 = r7_1 ^ r8_1;
+    const r14_1 = r12_1 ^ r13_1;
+    const o0_1 = r10_1 ^ r14_1;
+    const r15_1 = a6_1 ^ a10_1;
+    const r16_1 = r15_1 ^ r2_1;
+    const o1_1 = ~(r10_1 ^ r16_1);
+    const o2_1 = ~(a2_1 ^ r2_1);
+    const r17_1 = a12_1 ^ a13_1;
+    const r18_1 = a15_1 ^ r17_1;
+    const o3_1 = r18_1 ^ r11_1;
+    const r19_1 = a1_1 ^ a14_1;
+    const r20_1 = a17_1 ^ r3_1;
+    const r21_1 = r7_1 ^ r19_1;
+    const r22_1 = r5_1 ^ r20_1;
+    const o4_1 = r21_1 ^ r22_1;
+    const r23_1 = a9_1 ^ a12_1;
+    const o5_1 = r8_1 ^ r23_1;
+    const o6_1 = ~(r1_1 ^ r4_1);
+    const o7_1 = ~(a16_1 ^ r11_1);
+    const u0_2 = st[2];
+    const u1_2 = st[6];
+    const u2_2 = st[10];
+    const u3_2 = st[14];
+    const u4_2 = st[18];
+    const u5_2 = st[22];
+    const u6_2 = st[26];
+    const u7_2 = st[30];
+    const z24_2 = u3_2 ^ u4_2;
+    const q17_2 = u1_2 ^ u7_2;
+    const q16_2 = u5_2 ^ q17_2;
+    const q0_2 = z24_2 ^ q16_2;
+    const q7_2 = z24_2 ^ u1_2 ^ u6_2;
+    const q2_2 = u2_2 ^ q0_2;
+    const q1_2 = q7_2 ^ q2_2;
+    const q3_2 = u0_2 ^ q7_2;
+    const q4_2 = u0_2 ^ q2_2;
+    const q5_2 = u1_2 ^ q4_2;
+    const q6_2 = u2_2 ^ u3_2;
+    const q10_2 = q6_2 ^ q7_2;
+    const q8_2 = u0_2 ^ q10_2;
+    const q9_2 = q8_2 ^ q2_2;
+    const q12_2 = z24_2 ^ q17_2;
+    const q15_2 = u7_2 ^ q4_2;
+    const m02_2 = u0_2 ^ u2_2;
+    const m15_2 = u1_2 ^ u5_2;
+    const q13_2 = m02_2 ^ m15_2;
+    const q14_2 = m02_2 ^ u7_2;
+    const q11_2 = u5_2;
+    const t20_2 = q6_2 & q12_2;
+    const t21_2 = q3_2 & q14_2;
+    const t22_2 = q1_2 & q16_2;
+    const t23_2 = q2_2 & q17_2;
+    const x0_2 = (q3_2 | q14_2) ^ (q0_2 & q7_2) ^ (t20_2 ^ t22_2);
+    const x1_2 = (q4_2 | q13_2) ^ (q10_2 & q11_2) ^ (t21_2 ^ t20_2);
+    const x2_2 = (q2_2 | q17_2) ^ (q5_2 & q9_2) ^ (t21_2 ^ t22_2);
+    const x3_2 = (q8_2 | q15_2) ^ t23_2 ^ (t21_2 ^ (q4_2 & q13_2));
+    const va_2 = x1_2 & ~x3_2;
+    const vb_2 = x0_2 & ~x3_2;
+    const vc_2 = x3_2 & ~x1_2;
+    const vd_2 = x2_2 & ~x1_2;
+    const ve_2 = x0_2 ^ va_2;
+    const y0_2 = x3_2 ^ (x2_2 & ~ve_2);
+    const vf_2 = x1_2 ^ vb_2;
+    const y1_2 = vc_2 ^ (x2_2 & vf_2);
+    const vg_2 = x2_2 ^ vc_2;
+    const y2_2 = x1_2 ^ (x0_2 & ~vg_2);
+    const vh_2 = x3_2 ^ vd_2;
+    const y3_2 = va_2 ^ (x0_2 & vh_2);
+    const y02_2 = y2_2 ^ y0_2;
+    const y13_2 = y3_2 ^ y1_2;
+    const y23_2 = y3_2 ^ y2_2;
+    const y01_2 = y1_2 ^ y0_2;
+    const y00_2 = y02_2 ^ y13_2;
+    const a0_2 = y01_2 & q11_2;
+    const a1_2 = y0_2 & q12_2;
+    const a2_2 = y1_2 & q0_2;
+    const a3_2 = y23_2 & q17_2;
+    const a4_2 = y2_2 & q5_2;
+    const a5_2 = y3_2 & q15_2;
+    const a6_2 = y13_2 & q14_2;
+    const a7_2 = y00_2 & q16_2;
+    const a8_2 = y02_2 & q13_2;
+    const a9_2 = y01_2 & q7_2;
+    const a10_2 = y0_2 & q10_2;
+    const a11_2 = y1_2 & q6_2;
+    const a12_2 = y23_2 & q2_2;
+    const a13_2 = y2_2 & q9_2;
+    const a14_2 = y3_2 & q8_2;
+    const a15_2 = y13_2 & q3_2;
+    const a16_2 = y00_2 & q1_2;
+    const a17_2 = y02_2 & q4_2;
+    const r0_2 = a1_2 ^ a5_2;
+    const r1_2 = a9_2 ^ a15_2;
+    const r2_2 = a4_2 ^ r0_2;
+    const r3_2 = a2_2 ^ a10_2;
+    const r4_2 = a11_2 ^ a17_2;
+    const r5_2 = a8_2 ^ r1_2;
+    const r6_2 = a0_2 ^ a16_2;
+    const r7_2 = a7_2 ^ a13_2;
+    const r8_2 = a11_2 ^ a14_2;
+    const r9_2 = r3_2 ^ r4_2;
+    const r10_2 = r5_2 ^ r6_2;
+    const r11_2 = r2_2 ^ r9_2;
+    const r12_2 = a3_2 ^ r0_2;
+    const r13_2 = r7_2 ^ r8_2;
+    const r14_2 = r12_2 ^ r13_2;
+    const o0_2 = r10_2 ^ r14_2;
+    const r15_2 = a6_2 ^ a10_2;
+    const r16_2 = r15_2 ^ r2_2;
+    const o1_2 = ~(r10_2 ^ r16_2);
+    const o2_2 = ~(a2_2 ^ r2_2);
+    const r17_2 = a12_2 ^ a13_2;
+    const r18_2 = a15_2 ^ r17_2;
+    const o3_2 = r18_2 ^ r11_2;
+    const r19_2 = a1_2 ^ a14_2;
+    const r20_2 = a17_2 ^ r3_2;
+    const r21_2 = r7_2 ^ r19_2;
+    const r22_2 = r5_2 ^ r20_2;
+    const o4_2 = r21_2 ^ r22_2;
+    const r23_2 = a9_2 ^ a12_2;
+    const o5_2 = r8_2 ^ r23_2;
+    const o6_2 = ~(r1_2 ^ r4_2);
+    const o7_2 = ~(a16_2 ^ r11_2);
+    const u0_3 = st[3];
+    const u1_3 = st[7];
+    const u2_3 = st[11];
+    const u3_3 = st[15];
+    const u4_3 = st[19];
+    const u5_3 = st[23];
+    const u6_3 = st[27];
+    const u7_3 = st[31];
+    const z24_3 = u3_3 ^ u4_3;
+    const q17_3 = u1_3 ^ u7_3;
+    const q16_3 = u5_3 ^ q17_3;
+    const q0_3 = z24_3 ^ q16_3;
+    const q7_3 = z24_3 ^ u1_3 ^ u6_3;
+    const q2_3 = u2_3 ^ q0_3;
+    const q1_3 = q7_3 ^ q2_3;
+    const q3_3 = u0_3 ^ q7_3;
+    const q4_3 = u0_3 ^ q2_3;
+    const q5_3 = u1_3 ^ q4_3;
+    const q6_3 = u2_3 ^ u3_3;
+    const q10_3 = q6_3 ^ q7_3;
+    const q8_3 = u0_3 ^ q10_3;
+    const q9_3 = q8_3 ^ q2_3;
+    const q12_3 = z24_3 ^ q17_3;
+    const q15_3 = u7_3 ^ q4_3;
+    const m02_3 = u0_3 ^ u2_3;
+    const m15_3 = u1_3 ^ u5_3;
+    const q13_3 = m02_3 ^ m15_3;
+    const q14_3 = m02_3 ^ u7_3;
+    const q11_3 = u5_3;
+    const t20_3 = q6_3 & q12_3;
+    const t21_3 = q3_3 & q14_3;
+    const t22_3 = q1_3 & q16_3;
+    const t23_3 = q2_3 & q17_3;
+    const x0_3 = (q3_3 | q14_3) ^ (q0_3 & q7_3) ^ (t20_3 ^ t22_3);
+    const x1_3 = (q4_3 | q13_3) ^ (q10_3 & q11_3) ^ (t21_3 ^ t20_3);
+    const x2_3 = (q2_3 | q17_3) ^ (q5_3 & q9_3) ^ (t21_3 ^ t22_3);
+    const x3_3 = (q8_3 | q15_3) ^ t23_3 ^ (t21_3 ^ (q4_3 & q13_3));
+    const va_3 = x1_3 & ~x3_3;
+    const vb_3 = x0_3 & ~x3_3;
+    const vc_3 = x3_3 & ~x1_3;
+    const vd_3 = x2_3 & ~x1_3;
+    const ve_3 = x0_3 ^ va_3;
+    const y0_3 = x3_3 ^ (x2_3 & ~ve_3);
+    const vf_3 = x1_3 ^ vb_3;
+    const y1_3 = vc_3 ^ (x2_3 & vf_3);
+    const vg_3 = x2_3 ^ vc_3;
+    const y2_3 = x1_3 ^ (x0_3 & ~vg_3);
+    const vh_3 = x3_3 ^ vd_3;
+    const y3_3 = va_3 ^ (x0_3 & vh_3);
+    const y02_3 = y2_3 ^ y0_3;
+    const y13_3 = y3_3 ^ y1_3;
+    const y23_3 = y3_3 ^ y2_3;
+    const y01_3 = y1_3 ^ y0_3;
+    const y00_3 = y02_3 ^ y13_3;
+    const a0_3 = y01_3 & q11_3;
+    const a1_3 = y0_3 & q12_3;
+    const a2_3 = y1_3 & q0_3;
+    const a3_3 = y23_3 & q17_3;
+    const a4_3 = y2_3 & q5_3;
+    const a5_3 = y3_3 & q15_3;
+    const a6_3 = y13_3 & q14_3;
+    const a7_3 = y00_3 & q16_3;
+    const a8_3 = y02_3 & q13_3;
+    const a9_3 = y01_3 & q7_3;
+    const a10_3 = y0_3 & q10_3;
+    const a11_3 = y1_3 & q6_3;
+    const a12_3 = y23_3 & q2_3;
+    const a13_3 = y2_3 & q9_3;
+    const a14_3 = y3_3 & q8_3;
+    const a15_3 = y13_3 & q3_3;
+    const a16_3 = y00_3 & q1_3;
+    const a17_3 = y02_3 & q4_3;
+    const r0_3 = a1_3 ^ a5_3;
+    const r1_3 = a9_3 ^ a15_3;
+    const r2_3 = a4_3 ^ r0_3;
+    const r3_3 = a2_3 ^ a10_3;
+    const r4_3 = a11_3 ^ a17_3;
+    const r5_3 = a8_3 ^ r1_3;
+    const r6_3 = a0_3 ^ a16_3;
+    const r7_3 = a7_3 ^ a13_3;
+    const r8_3 = a11_3 ^ a14_3;
+    const r9_3 = r3_3 ^ r4_3;
+    const r10_3 = r5_3 ^ r6_3;
+    const r11_3 = r2_3 ^ r9_3;
+    const r12_3 = a3_3 ^ r0_3;
+    const r13_3 = r7_3 ^ r8_3;
+    const r14_3 = r12_3 ^ r13_3;
+    const o0_3 = r10_3 ^ r14_3;
+    const r15_3 = a6_3 ^ a10_3;
+    const r16_3 = r15_3 ^ r2_3;
+    const o1_3 = ~(r10_3 ^ r16_3);
+    const o2_3 = ~(a2_3 ^ r2_3);
+    const r17_3 = a12_3 ^ a13_3;
+    const r18_3 = a15_3 ^ r17_3;
+    const o3_3 = r18_3 ^ r11_3;
+    const r19_3 = a1_3 ^ a14_3;
+    const r20_3 = a17_3 ^ r3_3;
+    const r21_3 = r7_3 ^ r19_3;
+    const r22_3 = r5_3 ^ r20_3;
+    const o4_3 = r21_3 ^ r22_3;
+    const r23_3 = a9_3 ^ a12_3;
+    const o5_3 = r8_3 ^ r23_3;
+    const o6_3 = ~(r1_3 ^ r4_3);
+    const o7_3 = ~(a16_3 ^ r11_3);
+    const p0_1 = (o0_1 << 24) | (o0_1 >>> 8);
+    const p0_2 = (o0_2 << 16) | (o0_2 >>> 16);
+    const p0_3 = (o0_3 << 8) | (o0_3 >>> 24);
+    const p1_1 = (o1_1 << 24) | (o1_1 >>> 8);
+    const p1_2 = (o1_2 << 16) | (o1_2 >>> 16);
+    const p1_3 = (o1_3 << 8) | (o1_3 >>> 24);
+    const p2_1 = (o2_1 << 24) | (o2_1 >>> 8);
+    const p2_2 = (o2_2 << 16) | (o2_2 >>> 16);
+    const p2_3 = (o2_3 << 8) | (o2_3 >>> 24);
+    const p3_1 = (o3_1 << 24) | (o3_1 >>> 8);
+    const p3_2 = (o3_2 << 16) | (o3_2 >>> 16);
+    const p3_3 = (o3_3 << 8) | (o3_3 >>> 24);
+    const p4_1 = (o4_1 << 24) | (o4_1 >>> 8);
+    const p4_2 = (o4_2 << 16) | (o4_2 >>> 16);
+    const p4_3 = (o4_3 << 8) | (o4_3 >>> 24);
+    const p5_1 = (o5_1 << 24) | (o5_1 >>> 8);
+    const p5_2 = (o5_2 << 16) | (o5_2 >>> 16);
+    const p5_3 = (o5_3 << 8) | (o5_3 >>> 24);
+    const p6_1 = (o6_1 << 24) | (o6_1 >>> 8);
+    const p6_2 = (o6_2 << 16) | (o6_2 >>> 16);
+    const p6_3 = (o6_3 << 8) | (o6_3 >>> 24);
+    const p7_1 = (o7_1 << 24) | (o7_1 >>> 8);
+    const p7_2 = (o7_2 << 16) | (o7_2 >>> 16);
+    const p7_3 = (o7_3 << 8) | (o7_3 >>> 24);
+    const d0_0 = o0_0 ^ p0_1;
+    const d0_1 = p0_1 ^ p0_2;
+    const d0_2 = p0_2 ^ p0_3;
+    const d0_3 = p0_3 ^ o0_0;
+    const d1_0 = o1_0 ^ p1_1;
+    const d1_1 = p1_1 ^ p1_2;
+    const d1_2 = p1_2 ^ p1_3;
+    const d1_3 = p1_3 ^ o1_0;
+    const d2_0 = o2_0 ^ p2_1;
+    const d2_1 = p2_1 ^ p2_2;
+    const d2_2 = p2_2 ^ p2_3;
+    const d2_3 = p2_3 ^ o2_0;
+    const d3_0 = o3_0 ^ p3_1;
+    const d3_1 = p3_1 ^ p3_2;
+    const d3_2 = p3_2 ^ p3_3;
+    const d3_3 = p3_3 ^ o3_0;
+    const d4_0 = o4_0 ^ p4_1;
+    const d4_1 = p4_1 ^ p4_2;
+    const d4_2 = p4_2 ^ p4_3;
+    const d4_3 = p4_3 ^ o4_0;
+    const d5_0 = o5_0 ^ p5_1;
+    const d5_1 = p5_1 ^ p5_2;
+    const d5_2 = p5_2 ^ p5_3;
+    const d5_3 = p5_3 ^ o5_0;
+    const d6_0 = o6_0 ^ p6_1;
+    const d6_1 = p6_1 ^ p6_2;
+    const d6_2 = p6_2 ^ p6_3;
+    const d6_3 = p6_3 ^ o6_0;
+    const d7_0 = o7_0 ^ p7_1;
+    const d7_1 = p7_1 ^ p7_2;
+    const d7_2 = p7_2 ^ p7_3;
+    const d7_3 = p7_3 ^ o7_0;
+    const m0_0 = d1_0 ^ d0_1 ^ p0_3;
+    const m0_1 = d1_1 ^ d0_2 ^ o0_0;
+    const m0_2 = d1_2 ^ d0_3 ^ p0_1;
+    const m0_3 = d1_3 ^ d0_0 ^ p0_2;
+    const m1_0 = d2_0 ^ d1_1 ^ p1_3;
+    const m1_1 = d2_1 ^ d1_2 ^ o1_0;
+    const m1_2 = d2_2 ^ d1_3 ^ p1_1;
+    const m1_3 = d2_3 ^ d1_0 ^ p1_2;
+    const m2_0 = d3_0 ^ d2_1 ^ p2_3;
+    const m2_1 = d3_1 ^ d2_2 ^ o2_0;
+    const m2_2 = d3_2 ^ d2_3 ^ p2_1;
+    const m2_3 = d3_3 ^ d2_0 ^ p2_2;
+    const m3_0 = d4_0 ^ d3_1 ^ p3_3 ^ d0_0;
+    const m3_1 = d4_1 ^ d3_2 ^ o3_0 ^ d0_1;
+    const m3_2 = d4_2 ^ d3_3 ^ p3_1 ^ d0_2;
+    const m3_3 = d4_3 ^ d3_0 ^ p3_2 ^ d0_3;
+    const m4_0 = d5_0 ^ d4_1 ^ p4_3 ^ d0_0;
+    const m4_1 = d5_1 ^ d4_2 ^ o4_0 ^ d0_1;
+    const m4_2 = d5_2 ^ d4_3 ^ p4_1 ^ d0_2;
+    const m4_3 = d5_3 ^ d4_0 ^ p4_2 ^ d0_3;
+    const m5_0 = d6_0 ^ d5_1 ^ p5_3;
+    const m5_1 = d6_1 ^ d5_2 ^ o5_0;
+    const m5_2 = d6_2 ^ d5_3 ^ p5_1;
+    const m5_3 = d6_3 ^ d5_0 ^ p5_2;
+    const m6_0 = d7_0 ^ d6_1 ^ p6_3 ^ d0_0;
+    const m6_1 = d7_1 ^ d6_2 ^ o6_0 ^ d0_1;
+    const m6_2 = d7_2 ^ d6_3 ^ p6_1 ^ d0_2;
+    const m6_3 = d7_3 ^ d6_0 ^ p6_2 ^ d0_3;
+    const m7_0 = d0_0 ^ d7_1 ^ p7_3;
+    const m7_1 = d0_1 ^ d7_2 ^ o7_0;
+    const m7_2 = d0_2 ^ d7_3 ^ p7_1;
+    const m7_3 = d0_3 ^ d7_0 ^ p7_2;
+    st[0] =
+        st[0] ^
+            ci[0] ^
+            (((m0_0 & 0xfefefefe) >>> 1) | ((m0_0 & 0x01010101) << 7));
+    st[1] =
+        st[1] ^
+            ci[1] ^
+            (((m0_1 & 0xfefefefe) >>> 1) | ((m0_1 & 0x01010101) << 7));
+    st[2] =
+        st[2] ^
+            ci[2] ^
+            (((m0_2 & 0xfefefefe) >>> 1) | ((m0_2 & 0x01010101) << 7));
+    st[3] =
+        st[3] ^
+            ci[3] ^
+            (((m0_3 & 0xfefefefe) >>> 1) | ((m0_3 & 0x01010101) << 7));
+    st[4] =
+        st[4] ^
+            ci[4] ^
+            (((m1_0 & 0xfefefefe) >>> 1) | ((m1_0 & 0x01010101) << 7));
+    st[5] =
+        st[5] ^
+            ci[5] ^
+            (((m1_1 & 0xfefefefe) >>> 1) | ((m1_1 & 0x01010101) << 7));
+    st[6] =
+        st[6] ^
+            ci[6] ^
+            (((m1_2 & 0xfefefefe) >>> 1) | ((m1_2 & 0x01010101) << 7));
+    st[7] =
+        st[7] ^
+            ci[7] ^
+            (((m1_3 & 0xfefefefe) >>> 1) | ((m1_3 & 0x01010101) << 7));
+    st[8] =
+        st[8] ^
+            ci[8] ^
+            (((m2_0 & 0xfefefefe) >>> 1) | ((m2_0 & 0x01010101) << 7));
+    st[9] =
+        st[9] ^
+            ci[9] ^
+            (((m2_1 & 0xfefefefe) >>> 1) | ((m2_1 & 0x01010101) << 7));
+    st[10] =
+        st[10] ^
+            ci[10] ^
+            (((m2_2 & 0xfefefefe) >>> 1) | ((m2_2 & 0x01010101) << 7));
+    st[11] =
+        st[11] ^
+            ci[11] ^
+            (((m2_3 & 0xfefefefe) >>> 1) | ((m2_3 & 0x01010101) << 7));
+    st[12] =
+        st[12] ^
+            ci[12] ^
+            (((m3_0 & 0xfefefefe) >>> 1) | ((m3_0 & 0x01010101) << 7));
+    st[13] =
+        st[13] ^
+            ci[13] ^
+            (((m3_1 & 0xfefefefe) >>> 1) | ((m3_1 & 0x01010101) << 7));
+    st[14] =
+        st[14] ^
+            ci[14] ^
+            (((m3_2 & 0xfefefefe) >>> 1) | ((m3_2 & 0x01010101) << 7));
+    st[15] =
+        st[15] ^
+            ci[15] ^
+            (((m3_3 & 0xfefefefe) >>> 1) | ((m3_3 & 0x01010101) << 7));
+    st[16] =
+        st[16] ^
+            ci[16] ^
+            (((m4_0 & 0xfefefefe) >>> 1) | ((m4_0 & 0x01010101) << 7));
+    st[17] =
+        st[17] ^
+            ci[17] ^
+            (((m4_1 & 0xfefefefe) >>> 1) | ((m4_1 & 0x01010101) << 7));
+    st[18] =
+        st[18] ^
+            ci[18] ^
+            (((m4_2 & 0xfefefefe) >>> 1) | ((m4_2 & 0x01010101) << 7));
+    st[19] =
+        st[19] ^
+            ci[19] ^
+            (((m4_3 & 0xfefefefe) >>> 1) | ((m4_3 & 0x01010101) << 7));
+    st[20] =
+        st[20] ^
+            ci[20] ^
+            (((m5_0 & 0xfefefefe) >>> 1) | ((m5_0 & 0x01010101) << 7));
+    st[21] =
+        st[21] ^
+            ci[21] ^
+            (((m5_1 & 0xfefefefe) >>> 1) | ((m5_1 & 0x01010101) << 7));
+    st[22] =
+        st[22] ^
+            ci[22] ^
+            (((m5_2 & 0xfefefefe) >>> 1) | ((m5_2 & 0x01010101) << 7));
+    st[23] =
+        st[23] ^
+            ci[23] ^
+            (((m5_3 & 0xfefefefe) >>> 1) | ((m5_3 & 0x01010101) << 7));
+    st[24] =
+        st[24] ^
+            ci[24] ^
+            (((m6_0 & 0xfefefefe) >>> 1) | ((m6_0 & 0x01010101) << 7));
+    st[25] =
+        st[25] ^
+            ci[25] ^
+            (((m6_1 & 0xfefefefe) >>> 1) | ((m6_1 & 0x01010101) << 7));
+    st[26] =
+        st[26] ^
+            ci[26] ^
+            (((m6_2 & 0xfefefefe) >>> 1) | ((m6_2 & 0x01010101) << 7));
+    st[27] =
+        st[27] ^
+            ci[27] ^
+            (((m6_3 & 0xfefefefe) >>> 1) | ((m6_3 & 0x01010101) << 7));
+    st[28] =
+        st[28] ^
+            ci[28] ^
+            (((m7_0 & 0xfefefefe) >>> 1) | ((m7_0 & 0x01010101) << 7));
+    st[29] =
+        st[29] ^
+            ci[29] ^
+            (((m7_1 & 0xfefefefe) >>> 1) | ((m7_1 & 0x01010101) << 7));
+    st[30] =
+        st[30] ^
+            ci[30] ^
+            (((m7_2 & 0xfefefefe) >>> 1) | ((m7_2 & 0x01010101) << 7));
+    st[31] =
+        st[31] ^
+            ci[31] ^
+            (((m7_3 & 0xfefefefe) >>> 1) | ((m7_3 & 0x01010101) << 7));
 }
 /**
- * Put a single AES block into the bitsliced state at the given block position.
+ * Fused AEGIS-256 update round on the packed state:
+ * st = st ^ rotr6(AESRound(st)) ^ ci, where rotr6 rotates the 6 block lanes.
  */
-export function blocksPut(st, s, block) {
-    st[wordIdx(block, 0)] = s[0];
-    st[wordIdx(block, 1)] = s[1];
-    st[wordIdx(block, 2)] = s[2];
-    st[wordIdx(block, 3)] = s[3];
+export function aegisRound256(st, ci) {
+    const u0_0 = st[0];
+    const u1_0 = st[4];
+    const u2_0 = st[8];
+    const u3_0 = st[12];
+    const u4_0 = st[16];
+    const u5_0 = st[20];
+    const u6_0 = st[24];
+    const u7_0 = st[28];
+    const z24_0 = u3_0 ^ u4_0;
+    const q17_0 = u1_0 ^ u7_0;
+    const q16_0 = u5_0 ^ q17_0;
+    const q0_0 = z24_0 ^ q16_0;
+    const q7_0 = z24_0 ^ u1_0 ^ u6_0;
+    const q2_0 = u2_0 ^ q0_0;
+    const q1_0 = q7_0 ^ q2_0;
+    const q3_0 = u0_0 ^ q7_0;
+    const q4_0 = u0_0 ^ q2_0;
+    const q5_0 = u1_0 ^ q4_0;
+    const q6_0 = u2_0 ^ u3_0;
+    const q10_0 = q6_0 ^ q7_0;
+    const q8_0 = u0_0 ^ q10_0;
+    const q9_0 = q8_0 ^ q2_0;
+    const q12_0 = z24_0 ^ q17_0;
+    const q15_0 = u7_0 ^ q4_0;
+    const m02_0 = u0_0 ^ u2_0;
+    const m15_0 = u1_0 ^ u5_0;
+    const q13_0 = m02_0 ^ m15_0;
+    const q14_0 = m02_0 ^ u7_0;
+    const q11_0 = u5_0;
+    const t20_0 = q6_0 & q12_0;
+    const t21_0 = q3_0 & q14_0;
+    const t22_0 = q1_0 & q16_0;
+    const t23_0 = q2_0 & q17_0;
+    const x0_0 = (q3_0 | q14_0) ^ (q0_0 & q7_0) ^ (t20_0 ^ t22_0);
+    const x1_0 = (q4_0 | q13_0) ^ (q10_0 & q11_0) ^ (t21_0 ^ t20_0);
+    const x2_0 = (q2_0 | q17_0) ^ (q5_0 & q9_0) ^ (t21_0 ^ t22_0);
+    const x3_0 = (q8_0 | q15_0) ^ t23_0 ^ (t21_0 ^ (q4_0 & q13_0));
+    const va_0 = x1_0 & ~x3_0;
+    const vb_0 = x0_0 & ~x3_0;
+    const vc_0 = x3_0 & ~x1_0;
+    const vd_0 = x2_0 & ~x1_0;
+    const ve_0 = x0_0 ^ va_0;
+    const y0_0 = x3_0 ^ (x2_0 & ~ve_0);
+    const vf_0 = x1_0 ^ vb_0;
+    const y1_0 = vc_0 ^ (x2_0 & vf_0);
+    const vg_0 = x2_0 ^ vc_0;
+    const y2_0 = x1_0 ^ (x0_0 & ~vg_0);
+    const vh_0 = x3_0 ^ vd_0;
+    const y3_0 = va_0 ^ (x0_0 & vh_0);
+    const y02_0 = y2_0 ^ y0_0;
+    const y13_0 = y3_0 ^ y1_0;
+    const y23_0 = y3_0 ^ y2_0;
+    const y01_0 = y1_0 ^ y0_0;
+    const y00_0 = y02_0 ^ y13_0;
+    const a0_0 = y01_0 & q11_0;
+    const a1_0 = y0_0 & q12_0;
+    const a2_0 = y1_0 & q0_0;
+    const a3_0 = y23_0 & q17_0;
+    const a4_0 = y2_0 & q5_0;
+    const a5_0 = y3_0 & q15_0;
+    const a6_0 = y13_0 & q14_0;
+    const a7_0 = y00_0 & q16_0;
+    const a8_0 = y02_0 & q13_0;
+    const a9_0 = y01_0 & q7_0;
+    const a10_0 = y0_0 & q10_0;
+    const a11_0 = y1_0 & q6_0;
+    const a12_0 = y23_0 & q2_0;
+    const a13_0 = y2_0 & q9_0;
+    const a14_0 = y3_0 & q8_0;
+    const a15_0 = y13_0 & q3_0;
+    const a16_0 = y00_0 & q1_0;
+    const a17_0 = y02_0 & q4_0;
+    const r0_0 = a1_0 ^ a5_0;
+    const r1_0 = a9_0 ^ a15_0;
+    const r2_0 = a4_0 ^ r0_0;
+    const r3_0 = a2_0 ^ a10_0;
+    const r4_0 = a11_0 ^ a17_0;
+    const r5_0 = a8_0 ^ r1_0;
+    const r6_0 = a0_0 ^ a16_0;
+    const r7_0 = a7_0 ^ a13_0;
+    const r8_0 = a11_0 ^ a14_0;
+    const r9_0 = r3_0 ^ r4_0;
+    const r10_0 = r5_0 ^ r6_0;
+    const r11_0 = r2_0 ^ r9_0;
+    const r12_0 = a3_0 ^ r0_0;
+    const r13_0 = r7_0 ^ r8_0;
+    const r14_0 = r12_0 ^ r13_0;
+    const o0_0 = r10_0 ^ r14_0;
+    const r15_0 = a6_0 ^ a10_0;
+    const r16_0 = r15_0 ^ r2_0;
+    const o1_0 = ~(r10_0 ^ r16_0);
+    const o2_0 = ~(a2_0 ^ r2_0);
+    const r17_0 = a12_0 ^ a13_0;
+    const r18_0 = a15_0 ^ r17_0;
+    const o3_0 = r18_0 ^ r11_0;
+    const r19_0 = a1_0 ^ a14_0;
+    const r20_0 = a17_0 ^ r3_0;
+    const r21_0 = r7_0 ^ r19_0;
+    const r22_0 = r5_0 ^ r20_0;
+    const o4_0 = r21_0 ^ r22_0;
+    const r23_0 = a9_0 ^ a12_0;
+    const o5_0 = r8_0 ^ r23_0;
+    const o6_0 = ~(r1_0 ^ r4_0);
+    const o7_0 = ~(a16_0 ^ r11_0);
+    const u0_1 = st[1];
+    const u1_1 = st[5];
+    const u2_1 = st[9];
+    const u3_1 = st[13];
+    const u4_1 = st[17];
+    const u5_1 = st[21];
+    const u6_1 = st[25];
+    const u7_1 = st[29];
+    const z24_1 = u3_1 ^ u4_1;
+    const q17_1 = u1_1 ^ u7_1;
+    const q16_1 = u5_1 ^ q17_1;
+    const q0_1 = z24_1 ^ q16_1;
+    const q7_1 = z24_1 ^ u1_1 ^ u6_1;
+    const q2_1 = u2_1 ^ q0_1;
+    const q1_1 = q7_1 ^ q2_1;
+    const q3_1 = u0_1 ^ q7_1;
+    const q4_1 = u0_1 ^ q2_1;
+    const q5_1 = u1_1 ^ q4_1;
+    const q6_1 = u2_1 ^ u3_1;
+    const q10_1 = q6_1 ^ q7_1;
+    const q8_1 = u0_1 ^ q10_1;
+    const q9_1 = q8_1 ^ q2_1;
+    const q12_1 = z24_1 ^ q17_1;
+    const q15_1 = u7_1 ^ q4_1;
+    const m02_1 = u0_1 ^ u2_1;
+    const m15_1 = u1_1 ^ u5_1;
+    const q13_1 = m02_1 ^ m15_1;
+    const q14_1 = m02_1 ^ u7_1;
+    const q11_1 = u5_1;
+    const t20_1 = q6_1 & q12_1;
+    const t21_1 = q3_1 & q14_1;
+    const t22_1 = q1_1 & q16_1;
+    const t23_1 = q2_1 & q17_1;
+    const x0_1 = (q3_1 | q14_1) ^ (q0_1 & q7_1) ^ (t20_1 ^ t22_1);
+    const x1_1 = (q4_1 | q13_1) ^ (q10_1 & q11_1) ^ (t21_1 ^ t20_1);
+    const x2_1 = (q2_1 | q17_1) ^ (q5_1 & q9_1) ^ (t21_1 ^ t22_1);
+    const x3_1 = (q8_1 | q15_1) ^ t23_1 ^ (t21_1 ^ (q4_1 & q13_1));
+    const va_1 = x1_1 & ~x3_1;
+    const vb_1 = x0_1 & ~x3_1;
+    const vc_1 = x3_1 & ~x1_1;
+    const vd_1 = x2_1 & ~x1_1;
+    const ve_1 = x0_1 ^ va_1;
+    const y0_1 = x3_1 ^ (x2_1 & ~ve_1);
+    const vf_1 = x1_1 ^ vb_1;
+    const y1_1 = vc_1 ^ (x2_1 & vf_1);
+    const vg_1 = x2_1 ^ vc_1;
+    const y2_1 = x1_1 ^ (x0_1 & ~vg_1);
+    const vh_1 = x3_1 ^ vd_1;
+    const y3_1 = va_1 ^ (x0_1 & vh_1);
+    const y02_1 = y2_1 ^ y0_1;
+    const y13_1 = y3_1 ^ y1_1;
+    const y23_1 = y3_1 ^ y2_1;
+    const y01_1 = y1_1 ^ y0_1;
+    const y00_1 = y02_1 ^ y13_1;
+    const a0_1 = y01_1 & q11_1;
+    const a1_1 = y0_1 & q12_1;
+    const a2_1 = y1_1 & q0_1;
+    const a3_1 = y23_1 & q17_1;
+    const a4_1 = y2_1 & q5_1;
+    const a5_1 = y3_1 & q15_1;
+    const a6_1 = y13_1 & q14_1;
+    const a7_1 = y00_1 & q16_1;
+    const a8_1 = y02_1 & q13_1;
+    const a9_1 = y01_1 & q7_1;
+    const a10_1 = y0_1 & q10_1;
+    const a11_1 = y1_1 & q6_1;
+    const a12_1 = y23_1 & q2_1;
+    const a13_1 = y2_1 & q9_1;
+    const a14_1 = y3_1 & q8_1;
+    const a15_1 = y13_1 & q3_1;
+    const a16_1 = y00_1 & q1_1;
+    const a17_1 = y02_1 & q4_1;
+    const r0_1 = a1_1 ^ a5_1;
+    const r1_1 = a9_1 ^ a15_1;
+    const r2_1 = a4_1 ^ r0_1;
+    const r3_1 = a2_1 ^ a10_1;
+    const r4_1 = a11_1 ^ a17_1;
+    const r5_1 = a8_1 ^ r1_1;
+    const r6_1 = a0_1 ^ a16_1;
+    const r7_1 = a7_1 ^ a13_1;
+    const r8_1 = a11_1 ^ a14_1;
+    const r9_1 = r3_1 ^ r4_1;
+    const r10_1 = r5_1 ^ r6_1;
+    const r11_1 = r2_1 ^ r9_1;
+    const r12_1 = a3_1 ^ r0_1;
+    const r13_1 = r7_1 ^ r8_1;
+    const r14_1 = r12_1 ^ r13_1;
+    const o0_1 = r10_1 ^ r14_1;
+    const r15_1 = a6_1 ^ a10_1;
+    const r16_1 = r15_1 ^ r2_1;
+    const o1_1 = ~(r10_1 ^ r16_1);
+    const o2_1 = ~(a2_1 ^ r2_1);
+    const r17_1 = a12_1 ^ a13_1;
+    const r18_1 = a15_1 ^ r17_1;
+    const o3_1 = r18_1 ^ r11_1;
+    const r19_1 = a1_1 ^ a14_1;
+    const r20_1 = a17_1 ^ r3_1;
+    const r21_1 = r7_1 ^ r19_1;
+    const r22_1 = r5_1 ^ r20_1;
+    const o4_1 = r21_1 ^ r22_1;
+    const r23_1 = a9_1 ^ a12_1;
+    const o5_1 = r8_1 ^ r23_1;
+    const o6_1 = ~(r1_1 ^ r4_1);
+    const o7_1 = ~(a16_1 ^ r11_1);
+    const u0_2 = st[2];
+    const u1_2 = st[6];
+    const u2_2 = st[10];
+    const u3_2 = st[14];
+    const u4_2 = st[18];
+    const u5_2 = st[22];
+    const u6_2 = st[26];
+    const u7_2 = st[30];
+    const z24_2 = u3_2 ^ u4_2;
+    const q17_2 = u1_2 ^ u7_2;
+    const q16_2 = u5_2 ^ q17_2;
+    const q0_2 = z24_2 ^ q16_2;
+    const q7_2 = z24_2 ^ u1_2 ^ u6_2;
+    const q2_2 = u2_2 ^ q0_2;
+    const q1_2 = q7_2 ^ q2_2;
+    const q3_2 = u0_2 ^ q7_2;
+    const q4_2 = u0_2 ^ q2_2;
+    const q5_2 = u1_2 ^ q4_2;
+    const q6_2 = u2_2 ^ u3_2;
+    const q10_2 = q6_2 ^ q7_2;
+    const q8_2 = u0_2 ^ q10_2;
+    const q9_2 = q8_2 ^ q2_2;
+    const q12_2 = z24_2 ^ q17_2;
+    const q15_2 = u7_2 ^ q4_2;
+    const m02_2 = u0_2 ^ u2_2;
+    const m15_2 = u1_2 ^ u5_2;
+    const q13_2 = m02_2 ^ m15_2;
+    const q14_2 = m02_2 ^ u7_2;
+    const q11_2 = u5_2;
+    const t20_2 = q6_2 & q12_2;
+    const t21_2 = q3_2 & q14_2;
+    const t22_2 = q1_2 & q16_2;
+    const t23_2 = q2_2 & q17_2;
+    const x0_2 = (q3_2 | q14_2) ^ (q0_2 & q7_2) ^ (t20_2 ^ t22_2);
+    const x1_2 = (q4_2 | q13_2) ^ (q10_2 & q11_2) ^ (t21_2 ^ t20_2);
+    const x2_2 = (q2_2 | q17_2) ^ (q5_2 & q9_2) ^ (t21_2 ^ t22_2);
+    const x3_2 = (q8_2 | q15_2) ^ t23_2 ^ (t21_2 ^ (q4_2 & q13_2));
+    const va_2 = x1_2 & ~x3_2;
+    const vb_2 = x0_2 & ~x3_2;
+    const vc_2 = x3_2 & ~x1_2;
+    const vd_2 = x2_2 & ~x1_2;
+    const ve_2 = x0_2 ^ va_2;
+    const y0_2 = x3_2 ^ (x2_2 & ~ve_2);
+    const vf_2 = x1_2 ^ vb_2;
+    const y1_2 = vc_2 ^ (x2_2 & vf_2);
+    const vg_2 = x2_2 ^ vc_2;
+    const y2_2 = x1_2 ^ (x0_2 & ~vg_2);
+    const vh_2 = x3_2 ^ vd_2;
+    const y3_2 = va_2 ^ (x0_2 & vh_2);
+    const y02_2 = y2_2 ^ y0_2;
+    const y13_2 = y3_2 ^ y1_2;
+    const y23_2 = y3_2 ^ y2_2;
+    const y01_2 = y1_2 ^ y0_2;
+    const y00_2 = y02_2 ^ y13_2;
+    const a0_2 = y01_2 & q11_2;
+    const a1_2 = y0_2 & q12_2;
+    const a2_2 = y1_2 & q0_2;
+    const a3_2 = y23_2 & q17_2;
+    const a4_2 = y2_2 & q5_2;
+    const a5_2 = y3_2 & q15_2;
+    const a6_2 = y13_2 & q14_2;
+    const a7_2 = y00_2 & q16_2;
+    const a8_2 = y02_2 & q13_2;
+    const a9_2 = y01_2 & q7_2;
+    const a10_2 = y0_2 & q10_2;
+    const a11_2 = y1_2 & q6_2;
+    const a12_2 = y23_2 & q2_2;
+    const a13_2 = y2_2 & q9_2;
+    const a14_2 = y3_2 & q8_2;
+    const a15_2 = y13_2 & q3_2;
+    const a16_2 = y00_2 & q1_2;
+    const a17_2 = y02_2 & q4_2;
+    const r0_2 = a1_2 ^ a5_2;
+    const r1_2 = a9_2 ^ a15_2;
+    const r2_2 = a4_2 ^ r0_2;
+    const r3_2 = a2_2 ^ a10_2;
+    const r4_2 = a11_2 ^ a17_2;
+    const r5_2 = a8_2 ^ r1_2;
+    const r6_2 = a0_2 ^ a16_2;
+    const r7_2 = a7_2 ^ a13_2;
+    const r8_2 = a11_2 ^ a14_2;
+    const r9_2 = r3_2 ^ r4_2;
+    const r10_2 = r5_2 ^ r6_2;
+    const r11_2 = r2_2 ^ r9_2;
+    const r12_2 = a3_2 ^ r0_2;
+    const r13_2 = r7_2 ^ r8_2;
+    const r14_2 = r12_2 ^ r13_2;
+    const o0_2 = r10_2 ^ r14_2;
+    const r15_2 = a6_2 ^ a10_2;
+    const r16_2 = r15_2 ^ r2_2;
+    const o1_2 = ~(r10_2 ^ r16_2);
+    const o2_2 = ~(a2_2 ^ r2_2);
+    const r17_2 = a12_2 ^ a13_2;
+    const r18_2 = a15_2 ^ r17_2;
+    const o3_2 = r18_2 ^ r11_2;
+    const r19_2 = a1_2 ^ a14_2;
+    const r20_2 = a17_2 ^ r3_2;
+    const r21_2 = r7_2 ^ r19_2;
+    const r22_2 = r5_2 ^ r20_2;
+    const o4_2 = r21_2 ^ r22_2;
+    const r23_2 = a9_2 ^ a12_2;
+    const o5_2 = r8_2 ^ r23_2;
+    const o6_2 = ~(r1_2 ^ r4_2);
+    const o7_2 = ~(a16_2 ^ r11_2);
+    const u0_3 = st[3];
+    const u1_3 = st[7];
+    const u2_3 = st[11];
+    const u3_3 = st[15];
+    const u4_3 = st[19];
+    const u5_3 = st[23];
+    const u6_3 = st[27];
+    const u7_3 = st[31];
+    const z24_3 = u3_3 ^ u4_3;
+    const q17_3 = u1_3 ^ u7_3;
+    const q16_3 = u5_3 ^ q17_3;
+    const q0_3 = z24_3 ^ q16_3;
+    const q7_3 = z24_3 ^ u1_3 ^ u6_3;
+    const q2_3 = u2_3 ^ q0_3;
+    const q1_3 = q7_3 ^ q2_3;
+    const q3_3 = u0_3 ^ q7_3;
+    const q4_3 = u0_3 ^ q2_3;
+    const q5_3 = u1_3 ^ q4_3;
+    const q6_3 = u2_3 ^ u3_3;
+    const q10_3 = q6_3 ^ q7_3;
+    const q8_3 = u0_3 ^ q10_3;
+    const q9_3 = q8_3 ^ q2_3;
+    const q12_3 = z24_3 ^ q17_3;
+    const q15_3 = u7_3 ^ q4_3;
+    const m02_3 = u0_3 ^ u2_3;
+    const m15_3 = u1_3 ^ u5_3;
+    const q13_3 = m02_3 ^ m15_3;
+    const q14_3 = m02_3 ^ u7_3;
+    const q11_3 = u5_3;
+    const t20_3 = q6_3 & q12_3;
+    const t21_3 = q3_3 & q14_3;
+    const t22_3 = q1_3 & q16_3;
+    const t23_3 = q2_3 & q17_3;
+    const x0_3 = (q3_3 | q14_3) ^ (q0_3 & q7_3) ^ (t20_3 ^ t22_3);
+    const x1_3 = (q4_3 | q13_3) ^ (q10_3 & q11_3) ^ (t21_3 ^ t20_3);
+    const x2_3 = (q2_3 | q17_3) ^ (q5_3 & q9_3) ^ (t21_3 ^ t22_3);
+    const x3_3 = (q8_3 | q15_3) ^ t23_3 ^ (t21_3 ^ (q4_3 & q13_3));
+    const va_3 = x1_3 & ~x3_3;
+    const vb_3 = x0_3 & ~x3_3;
+    const vc_3 = x3_3 & ~x1_3;
+    const vd_3 = x2_3 & ~x1_3;
+    const ve_3 = x0_3 ^ va_3;
+    const y0_3 = x3_3 ^ (x2_3 & ~ve_3);
+    const vf_3 = x1_3 ^ vb_3;
+    const y1_3 = vc_3 ^ (x2_3 & vf_3);
+    const vg_3 = x2_3 ^ vc_3;
+    const y2_3 = x1_3 ^ (x0_3 & ~vg_3);
+    const vh_3 = x3_3 ^ vd_3;
+    const y3_3 = va_3 ^ (x0_3 & vh_3);
+    const y02_3 = y2_3 ^ y0_3;
+    const y13_3 = y3_3 ^ y1_3;
+    const y23_3 = y3_3 ^ y2_3;
+    const y01_3 = y1_3 ^ y0_3;
+    const y00_3 = y02_3 ^ y13_3;
+    const a0_3 = y01_3 & q11_3;
+    const a1_3 = y0_3 & q12_3;
+    const a2_3 = y1_3 & q0_3;
+    const a3_3 = y23_3 & q17_3;
+    const a4_3 = y2_3 & q5_3;
+    const a5_3 = y3_3 & q15_3;
+    const a6_3 = y13_3 & q14_3;
+    const a7_3 = y00_3 & q16_3;
+    const a8_3 = y02_3 & q13_3;
+    const a9_3 = y01_3 & q7_3;
+    const a10_3 = y0_3 & q10_3;
+    const a11_3 = y1_3 & q6_3;
+    const a12_3 = y23_3 & q2_3;
+    const a13_3 = y2_3 & q9_3;
+    const a14_3 = y3_3 & q8_3;
+    const a15_3 = y13_3 & q3_3;
+    const a16_3 = y00_3 & q1_3;
+    const a17_3 = y02_3 & q4_3;
+    const r0_3 = a1_3 ^ a5_3;
+    const r1_3 = a9_3 ^ a15_3;
+    const r2_3 = a4_3 ^ r0_3;
+    const r3_3 = a2_3 ^ a10_3;
+    const r4_3 = a11_3 ^ a17_3;
+    const r5_3 = a8_3 ^ r1_3;
+    const r6_3 = a0_3 ^ a16_3;
+    const r7_3 = a7_3 ^ a13_3;
+    const r8_3 = a11_3 ^ a14_3;
+    const r9_3 = r3_3 ^ r4_3;
+    const r10_3 = r5_3 ^ r6_3;
+    const r11_3 = r2_3 ^ r9_3;
+    const r12_3 = a3_3 ^ r0_3;
+    const r13_3 = r7_3 ^ r8_3;
+    const r14_3 = r12_3 ^ r13_3;
+    const o0_3 = r10_3 ^ r14_3;
+    const r15_3 = a6_3 ^ a10_3;
+    const r16_3 = r15_3 ^ r2_3;
+    const o1_3 = ~(r10_3 ^ r16_3);
+    const o2_3 = ~(a2_3 ^ r2_3);
+    const r17_3 = a12_3 ^ a13_3;
+    const r18_3 = a15_3 ^ r17_3;
+    const o3_3 = r18_3 ^ r11_3;
+    const r19_3 = a1_3 ^ a14_3;
+    const r20_3 = a17_3 ^ r3_3;
+    const r21_3 = r7_3 ^ r19_3;
+    const r22_3 = r5_3 ^ r20_3;
+    const o4_3 = r21_3 ^ r22_3;
+    const r23_3 = a9_3 ^ a12_3;
+    const o5_3 = r8_3 ^ r23_3;
+    const o6_3 = ~(r1_3 ^ r4_3);
+    const o7_3 = ~(a16_3 ^ r11_3);
+    const p0_1 = (o0_1 << 24) | (o0_1 >>> 8);
+    const p0_2 = (o0_2 << 16) | (o0_2 >>> 16);
+    const p0_3 = (o0_3 << 8) | (o0_3 >>> 24);
+    const p1_1 = (o1_1 << 24) | (o1_1 >>> 8);
+    const p1_2 = (o1_2 << 16) | (o1_2 >>> 16);
+    const p1_3 = (o1_3 << 8) | (o1_3 >>> 24);
+    const p2_1 = (o2_1 << 24) | (o2_1 >>> 8);
+    const p2_2 = (o2_2 << 16) | (o2_2 >>> 16);
+    const p2_3 = (o2_3 << 8) | (o2_3 >>> 24);
+    const p3_1 = (o3_1 << 24) | (o3_1 >>> 8);
+    const p3_2 = (o3_2 << 16) | (o3_2 >>> 16);
+    const p3_3 = (o3_3 << 8) | (o3_3 >>> 24);
+    const p4_1 = (o4_1 << 24) | (o4_1 >>> 8);
+    const p4_2 = (o4_2 << 16) | (o4_2 >>> 16);
+    const p4_3 = (o4_3 << 8) | (o4_3 >>> 24);
+    const p5_1 = (o5_1 << 24) | (o5_1 >>> 8);
+    const p5_2 = (o5_2 << 16) | (o5_2 >>> 16);
+    const p5_3 = (o5_3 << 8) | (o5_3 >>> 24);
+    const p6_1 = (o6_1 << 24) | (o6_1 >>> 8);
+    const p6_2 = (o6_2 << 16) | (o6_2 >>> 16);
+    const p6_3 = (o6_3 << 8) | (o6_3 >>> 24);
+    const p7_1 = (o7_1 << 24) | (o7_1 >>> 8);
+    const p7_2 = (o7_2 << 16) | (o7_2 >>> 16);
+    const p7_3 = (o7_3 << 8) | (o7_3 >>> 24);
+    const d0_0 = o0_0 ^ p0_1;
+    const d0_1 = p0_1 ^ p0_2;
+    const d0_2 = p0_2 ^ p0_3;
+    const d0_3 = p0_3 ^ o0_0;
+    const d1_0 = o1_0 ^ p1_1;
+    const d1_1 = p1_1 ^ p1_2;
+    const d1_2 = p1_2 ^ p1_3;
+    const d1_3 = p1_3 ^ o1_0;
+    const d2_0 = o2_0 ^ p2_1;
+    const d2_1 = p2_1 ^ p2_2;
+    const d2_2 = p2_2 ^ p2_3;
+    const d2_3 = p2_3 ^ o2_0;
+    const d3_0 = o3_0 ^ p3_1;
+    const d3_1 = p3_1 ^ p3_2;
+    const d3_2 = p3_2 ^ p3_3;
+    const d3_3 = p3_3 ^ o3_0;
+    const d4_0 = o4_0 ^ p4_1;
+    const d4_1 = p4_1 ^ p4_2;
+    const d4_2 = p4_2 ^ p4_3;
+    const d4_3 = p4_3 ^ o4_0;
+    const d5_0 = o5_0 ^ p5_1;
+    const d5_1 = p5_1 ^ p5_2;
+    const d5_2 = p5_2 ^ p5_3;
+    const d5_3 = p5_3 ^ o5_0;
+    const d6_0 = o6_0 ^ p6_1;
+    const d6_1 = p6_1 ^ p6_2;
+    const d6_2 = p6_2 ^ p6_3;
+    const d6_3 = p6_3 ^ o6_0;
+    const d7_0 = o7_0 ^ p7_1;
+    const d7_1 = p7_1 ^ p7_2;
+    const d7_2 = p7_2 ^ p7_3;
+    const d7_3 = p7_3 ^ o7_0;
+    const m0_0 = d1_0 ^ d0_1 ^ p0_3;
+    const m0_1 = d1_1 ^ d0_2 ^ o0_0;
+    const m0_2 = d1_2 ^ d0_3 ^ p0_1;
+    const m0_3 = d1_3 ^ d0_0 ^ p0_2;
+    const m1_0 = d2_0 ^ d1_1 ^ p1_3;
+    const m1_1 = d2_1 ^ d1_2 ^ o1_0;
+    const m1_2 = d2_2 ^ d1_3 ^ p1_1;
+    const m1_3 = d2_3 ^ d1_0 ^ p1_2;
+    const m2_0 = d3_0 ^ d2_1 ^ p2_3;
+    const m2_1 = d3_1 ^ d2_2 ^ o2_0;
+    const m2_2 = d3_2 ^ d2_3 ^ p2_1;
+    const m2_3 = d3_3 ^ d2_0 ^ p2_2;
+    const m3_0 = d4_0 ^ d3_1 ^ p3_3 ^ d0_0;
+    const m3_1 = d4_1 ^ d3_2 ^ o3_0 ^ d0_1;
+    const m3_2 = d4_2 ^ d3_3 ^ p3_1 ^ d0_2;
+    const m3_3 = d4_3 ^ d3_0 ^ p3_2 ^ d0_3;
+    const m4_0 = d5_0 ^ d4_1 ^ p4_3 ^ d0_0;
+    const m4_1 = d5_1 ^ d4_2 ^ o4_0 ^ d0_1;
+    const m4_2 = d5_2 ^ d4_3 ^ p4_1 ^ d0_2;
+    const m4_3 = d5_3 ^ d4_0 ^ p4_2 ^ d0_3;
+    const m5_0 = d6_0 ^ d5_1 ^ p5_3;
+    const m5_1 = d6_1 ^ d5_2 ^ o5_0;
+    const m5_2 = d6_2 ^ d5_3 ^ p5_1;
+    const m5_3 = d6_3 ^ d5_0 ^ p5_2;
+    const m6_0 = d7_0 ^ d6_1 ^ p6_3 ^ d0_0;
+    const m6_1 = d7_1 ^ d6_2 ^ o6_0 ^ d0_1;
+    const m6_2 = d7_2 ^ d6_3 ^ p6_1 ^ d0_2;
+    const m6_3 = d7_3 ^ d6_0 ^ p6_2 ^ d0_3;
+    const m7_0 = d0_0 ^ d7_1 ^ p7_3;
+    const m7_1 = d0_1 ^ d7_2 ^ o7_0;
+    const m7_2 = d0_2 ^ d7_3 ^ p7_1;
+    const m7_3 = d0_3 ^ d7_0 ^ p7_2;
+    st[0] =
+        st[0] ^
+            ci[0] ^
+            (((m0_0 & 0xf8f8f8f8) >>> 1) | ((m0_0 & 0x04040404) << 5));
+    st[1] =
+        st[1] ^
+            ci[1] ^
+            (((m0_1 & 0xf8f8f8f8) >>> 1) | ((m0_1 & 0x04040404) << 5));
+    st[2] =
+        st[2] ^
+            ci[2] ^
+            (((m0_2 & 0xf8f8f8f8) >>> 1) | ((m0_2 & 0x04040404) << 5));
+    st[3] =
+        st[3] ^
+            ci[3] ^
+            (((m0_3 & 0xf8f8f8f8) >>> 1) | ((m0_3 & 0x04040404) << 5));
+    st[4] =
+        st[4] ^
+            ci[4] ^
+            (((m1_0 & 0xf8f8f8f8) >>> 1) | ((m1_0 & 0x04040404) << 5));
+    st[5] =
+        st[5] ^
+            ci[5] ^
+            (((m1_1 & 0xf8f8f8f8) >>> 1) | ((m1_1 & 0x04040404) << 5));
+    st[6] =
+        st[6] ^
+            ci[6] ^
+            (((m1_2 & 0xf8f8f8f8) >>> 1) | ((m1_2 & 0x04040404) << 5));
+    st[7] =
+        st[7] ^
+            ci[7] ^
+            (((m1_3 & 0xf8f8f8f8) >>> 1) | ((m1_3 & 0x04040404) << 5));
+    st[8] =
+        st[8] ^
+            ci[8] ^
+            (((m2_0 & 0xf8f8f8f8) >>> 1) | ((m2_0 & 0x04040404) << 5));
+    st[9] =
+        st[9] ^
+            ci[9] ^
+            (((m2_1 & 0xf8f8f8f8) >>> 1) | ((m2_1 & 0x04040404) << 5));
+    st[10] =
+        st[10] ^
+            ci[10] ^
+            (((m2_2 & 0xf8f8f8f8) >>> 1) | ((m2_2 & 0x04040404) << 5));
+    st[11] =
+        st[11] ^
+            ci[11] ^
+            (((m2_3 & 0xf8f8f8f8) >>> 1) | ((m2_3 & 0x04040404) << 5));
+    st[12] =
+        st[12] ^
+            ci[12] ^
+            (((m3_0 & 0xf8f8f8f8) >>> 1) | ((m3_0 & 0x04040404) << 5));
+    st[13] =
+        st[13] ^
+            ci[13] ^
+            (((m3_1 & 0xf8f8f8f8) >>> 1) | ((m3_1 & 0x04040404) << 5));
+    st[14] =
+        st[14] ^
+            ci[14] ^
+            (((m3_2 & 0xf8f8f8f8) >>> 1) | ((m3_2 & 0x04040404) << 5));
+    st[15] =
+        st[15] ^
+            ci[15] ^
+            (((m3_3 & 0xf8f8f8f8) >>> 1) | ((m3_3 & 0x04040404) << 5));
+    st[16] =
+        st[16] ^
+            ci[16] ^
+            (((m4_0 & 0xf8f8f8f8) >>> 1) | ((m4_0 & 0x04040404) << 5));
+    st[17] =
+        st[17] ^
+            ci[17] ^
+            (((m4_1 & 0xf8f8f8f8) >>> 1) | ((m4_1 & 0x04040404) << 5));
+    st[18] =
+        st[18] ^
+            ci[18] ^
+            (((m4_2 & 0xf8f8f8f8) >>> 1) | ((m4_2 & 0x04040404) << 5));
+    st[19] =
+        st[19] ^
+            ci[19] ^
+            (((m4_3 & 0xf8f8f8f8) >>> 1) | ((m4_3 & 0x04040404) << 5));
+    st[20] =
+        st[20] ^
+            ci[20] ^
+            (((m5_0 & 0xf8f8f8f8) >>> 1) | ((m5_0 & 0x04040404) << 5));
+    st[21] =
+        st[21] ^
+            ci[21] ^
+            (((m5_1 & 0xf8f8f8f8) >>> 1) | ((m5_1 & 0x04040404) << 5));
+    st[22] =
+        st[22] ^
+            ci[22] ^
+            (((m5_2 & 0xf8f8f8f8) >>> 1) | ((m5_2 & 0x04040404) << 5));
+    st[23] =
+        st[23] ^
+            ci[23] ^
+            (((m5_3 & 0xf8f8f8f8) >>> 1) | ((m5_3 & 0x04040404) << 5));
+    st[24] =
+        st[24] ^
+            ci[24] ^
+            (((m6_0 & 0xf8f8f8f8) >>> 1) | ((m6_0 & 0x04040404) << 5));
+    st[25] =
+        st[25] ^
+            ci[25] ^
+            (((m6_1 & 0xf8f8f8f8) >>> 1) | ((m6_1 & 0x04040404) << 5));
+    st[26] =
+        st[26] ^
+            ci[26] ^
+            (((m6_2 & 0xf8f8f8f8) >>> 1) | ((m6_2 & 0x04040404) << 5));
+    st[27] =
+        st[27] ^
+            ci[27] ^
+            (((m6_3 & 0xf8f8f8f8) >>> 1) | ((m6_3 & 0x04040404) << 5));
+    st[28] =
+        st[28] ^
+            ci[28] ^
+            (((m7_0 & 0xf8f8f8f8) >>> 1) | ((m7_0 & 0x04040404) << 5));
+    st[29] =
+        st[29] ^
+            ci[29] ^
+            (((m7_1 & 0xf8f8f8f8) >>> 1) | ((m7_1 & 0x04040404) << 5));
+    st[30] =
+        st[30] ^
+            ci[30] ^
+            (((m7_2 & 0xf8f8f8f8) >>> 1) | ((m7_2 & 0x04040404) << 5));
+    st[31] =
+        st[31] ^
+            ci[31] ^
+            (((m7_3 & 0xf8f8f8f8) >>> 1) | ((m7_3 & 0x04040404) << 5));
 }
 /**
- * Load a 16-byte buffer into an AES block (4 uint32 little-endian).
+ * Pack two message blocks (at positions 0 and 4) into a constant-input state
+ * for the AEGIS-128L round. Specialized pack04 exploiting the sparse input.
  */
-export function blockFromBytes(out, src) {
-    const view = new DataView(src.buffer, src.byteOffset, src.byteLength);
-    out[0] = view.getUint32(0, true);
-    out[1] = view.getUint32(4, true);
-    out[2] = view.getUint32(8, true);
-    out[3] = view.getUint32(12, true);
+export function packConstantInput128(out, m0, m1) {
+    const a0 = m0[0];
+    const a1 = m0[1];
+    const a2 = m0[2];
+    const a3 = m0[3];
+    const b0 = m1[0];
+    const b1 = m1[1];
+    const b2 = m1[2];
+    const b3 = m1[3];
+    const t0 = (a1 ^ (a0 >>> 8)) & 0x00ff00ff;
+    const t1 = a1 ^ t0;
+    const t2 = a0 ^ (t0 << 8);
+    const t3 = (a3 ^ (a2 >>> 8)) & 0x00ff00ff;
+    const t4 = a3 ^ t3;
+    const t5 = a2 ^ (t3 << 8);
+    const t6 = (b1 ^ (b0 >>> 8)) & 0x00ff00ff;
+    const t7 = b1 ^ t6;
+    const t8 = b0 ^ (t6 << 8);
+    const t9 = (b3 ^ (b2 >>> 8)) & 0x00ff00ff;
+    const t10 = b3 ^ t9;
+    const t11 = b2 ^ (t9 << 8);
+    const t12 = (t5 ^ (t2 >>> 16)) & 0x0000ffff;
+    const t13 = t5 ^ t12;
+    const t14 = t2 ^ (t12 << 16);
+    const t15 = (t11 ^ (t8 >>> 16)) & 0x0000ffff;
+    const t16 = t11 ^ t15;
+    const t17 = t8 ^ (t15 << 16);
+    const t18 = (t4 ^ (t1 >>> 16)) & 0x0000ffff;
+    const t19 = t4 ^ t18;
+    const t20 = t1 ^ (t18 << 16);
+    const t21 = (t10 ^ (t7 >>> 16)) & 0x0000ffff;
+    const t22 = t10 ^ t21;
+    const t23 = t7 ^ (t21 << 16);
+    const t24 = t14 & 0x55555555;
+    const t25 = t14 ^ t24;
+    const t26 = t24 << 1;
+    const t27 = t17 & 0x55555555;
+    const t28 = t17 ^ t27;
+    const t29 = t27 << 1;
+    const t30 = t25 & 0x33333333;
+    const t31 = t25 ^ t30;
+    const t32 = t30 << 2;
+    const t33 = t26 & 0x33333333;
+    const t34 = t26 ^ t33;
+    const t35 = t33 << 2;
+    const t36 = t28 & 0x33333333;
+    const t37 = t28 ^ t36;
+    const t38 = t36 << 2;
+    const t39 = t29 & 0x33333333;
+    const t40 = t29 ^ t39;
+    const t41 = t39 << 2;
+    const t42 = (t31 ^ (t37 >>> 4)) & 0x0f0f0f0f;
+    const t43 = t31 ^ t42;
+    const t44 = t37 ^ (t42 << 4);
+    const t45 = (t34 ^ (t40 >>> 4)) & 0x0f0f0f0f;
+    const t46 = t34 ^ t45;
+    const t47 = t40 ^ (t45 << 4);
+    const t48 = (t32 ^ (t38 >>> 4)) & 0x0f0f0f0f;
+    const t49 = t32 ^ t48;
+    const t50 = t38 ^ (t48 << 4);
+    const t51 = (t35 ^ (t41 >>> 4)) & 0x0f0f0f0f;
+    const t52 = t35 ^ t51;
+    const t53 = t41 ^ (t51 << 4);
+    const t54 = t20 & 0x55555555;
+    const t55 = t20 ^ t54;
+    const t56 = t54 << 1;
+    const t57 = t23 & 0x55555555;
+    const t58 = t23 ^ t57;
+    const t59 = t57 << 1;
+    const t60 = t55 & 0x33333333;
+    const t61 = t55 ^ t60;
+    const t62 = t60 << 2;
+    const t63 = t56 & 0x33333333;
+    const t64 = t56 ^ t63;
+    const t65 = t63 << 2;
+    const t66 = t58 & 0x33333333;
+    const t67 = t58 ^ t66;
+    const t68 = t66 << 2;
+    const t69 = t59 & 0x33333333;
+    const t70 = t59 ^ t69;
+    const t71 = t69 << 2;
+    const t72 = (t61 ^ (t67 >>> 4)) & 0x0f0f0f0f;
+    const t73 = t61 ^ t72;
+    const t74 = t67 ^ (t72 << 4);
+    const t75 = (t64 ^ (t70 >>> 4)) & 0x0f0f0f0f;
+    const t76 = t64 ^ t75;
+    const t77 = t70 ^ (t75 << 4);
+    const t78 = (t62 ^ (t68 >>> 4)) & 0x0f0f0f0f;
+    const t79 = t62 ^ t78;
+    const t80 = t68 ^ (t78 << 4);
+    const t81 = (t65 ^ (t71 >>> 4)) & 0x0f0f0f0f;
+    const t82 = t65 ^ t81;
+    const t83 = t71 ^ (t81 << 4);
+    const t84 = t13 & 0x55555555;
+    const t85 = t13 ^ t84;
+    const t86 = t84 << 1;
+    const t87 = t16 & 0x55555555;
+    const t88 = t16 ^ t87;
+    const t89 = t87 << 1;
+    const t90 = t85 & 0x33333333;
+    const t91 = t85 ^ t90;
+    const t92 = t90 << 2;
+    const t93 = t86 & 0x33333333;
+    const t94 = t86 ^ t93;
+    const t95 = t93 << 2;
+    const t96 = t88 & 0x33333333;
+    const t97 = t88 ^ t96;
+    const t98 = t96 << 2;
+    const t99 = t89 & 0x33333333;
+    const t100 = t89 ^ t99;
+    const t101 = t99 << 2;
+    const t102 = (t91 ^ (t97 >>> 4)) & 0x0f0f0f0f;
+    const t103 = t91 ^ t102;
+    const t104 = t97 ^ (t102 << 4);
+    const t105 = (t94 ^ (t100 >>> 4)) & 0x0f0f0f0f;
+    const t106 = t94 ^ t105;
+    const t107 = t100 ^ (t105 << 4);
+    const t108 = (t92 ^ (t98 >>> 4)) & 0x0f0f0f0f;
+    const t109 = t92 ^ t108;
+    const t110 = t98 ^ (t108 << 4);
+    const t111 = (t95 ^ (t101 >>> 4)) & 0x0f0f0f0f;
+    const t112 = t95 ^ t111;
+    const t113 = t101 ^ (t111 << 4);
+    const t114 = t19 & 0x55555555;
+    const t115 = t19 ^ t114;
+    const t116 = t114 << 1;
+    const t117 = t22 & 0x55555555;
+    const t118 = t22 ^ t117;
+    const t119 = t117 << 1;
+    const t120 = t115 & 0x33333333;
+    const t121 = t115 ^ t120;
+    const t122 = t120 << 2;
+    const t123 = t116 & 0x33333333;
+    const t124 = t116 ^ t123;
+    const t125 = t123 << 2;
+    const t126 = t118 & 0x33333333;
+    const t127 = t118 ^ t126;
+    const t128 = t126 << 2;
+    const t129 = t119 & 0x33333333;
+    const t130 = t119 ^ t129;
+    const t131 = t129 << 2;
+    const t132 = (t121 ^ (t127 >>> 4)) & 0x0f0f0f0f;
+    const t133 = t121 ^ t132;
+    const t134 = t127 ^ (t132 << 4);
+    const t135 = (t124 ^ (t130 >>> 4)) & 0x0f0f0f0f;
+    const t136 = t124 ^ t135;
+    const t137 = t130 ^ (t135 << 4);
+    const t138 = (t122 ^ (t128 >>> 4)) & 0x0f0f0f0f;
+    const t139 = t122 ^ t138;
+    const t140 = t128 ^ (t138 << 4);
+    const t141 = (t125 ^ (t131 >>> 4)) & 0x0f0f0f0f;
+    const t142 = t125 ^ t141;
+    const t143 = t131 ^ (t141 << 4);
+    out[0] = t43;
+    out[1] = t73;
+    out[2] = t103;
+    out[3] = t133;
+    out[4] = t46;
+    out[5] = t76;
+    out[6] = t106;
+    out[7] = t136;
+    out[8] = t49;
+    out[9] = t79;
+    out[10] = t109;
+    out[11] = t139;
+    out[12] = t52;
+    out[13] = t82;
+    out[14] = t112;
+    out[15] = t142;
+    out[16] = t44;
+    out[17] = t74;
+    out[18] = t104;
+    out[19] = t134;
+    out[20] = t47;
+    out[21] = t77;
+    out[22] = t107;
+    out[23] = t137;
+    out[24] = t50;
+    out[25] = t80;
+    out[26] = t110;
+    out[27] = t140;
+    out[28] = t53;
+    out[29] = t83;
+    out[30] = t113;
+    out[31] = t143;
 }
 /**
- * Store an AES block to a 16-byte buffer (little-endian).
+ * Pack one message block (at position 0) into a constant-input state for the
+ * AEGIS-256 round. Specialized pack04_6 exploiting the sparse input.
  */
-export function blockToBytes(out, src) {
-    const view = new DataView(out.buffer, out.byteOffset, out.byteLength);
-    view.setUint32(0, src[0], true);
-    view.setUint32(4, src[1], true);
-    view.setUint32(8, src[2], true);
-    view.setUint32(12, src[3], true);
+export function packConstantInput256(out, m) {
+    const a0 = m[0];
+    const a1 = m[1];
+    const a2 = m[2];
+    const a3 = m[3];
+    const t0 = (a1 ^ (a0 >>> 8)) & 0x00ff00ff;
+    const t1 = a1 ^ t0;
+    const t2 = a0 ^ (t0 << 8);
+    const t3 = (a3 ^ (a2 >>> 8)) & 0x00ff00ff;
+    const t4 = a3 ^ t3;
+    const t5 = a2 ^ (t3 << 8);
+    const t6 = (t5 ^ (t2 >>> 16)) & 0x0000ffff;
+    const t7 = t5 ^ t6;
+    const t8 = t2 ^ (t6 << 16);
+    const t9 = (t4 ^ (t1 >>> 16)) & 0x0000ffff;
+    const t10 = t4 ^ t9;
+    const t11 = t1 ^ (t9 << 16);
+    const t12 = t8 & 0x55555555;
+    const t13 = t8 ^ t12;
+    const t14 = t12 << 1;
+    const t15 = t13 & 0x33333333;
+    const t16 = t13 ^ t15;
+    const t17 = t15 << 2;
+    const t18 = t14 & 0x33333333;
+    const t19 = t14 ^ t18;
+    const t20 = t18 << 2;
+    const t21 = t16 & 0x0f0f0f0f;
+    const t22 = t16 ^ t21;
+    const t23 = t21 << 4;
+    const t24 = t19 & 0x0f0f0f0f;
+    const t25 = t19 ^ t24;
+    const t26 = t24 << 4;
+    const t27 = t17 & 0x0f0f0f0f;
+    const t28 = t17 ^ t27;
+    const t29 = t27 << 4;
+    const t30 = t20 & 0x0f0f0f0f;
+    const t31 = t20 ^ t30;
+    const t32 = t30 << 4;
+    const t33 = t11 & 0x55555555;
+    const t34 = t11 ^ t33;
+    const t35 = t33 << 1;
+    const t36 = t34 & 0x33333333;
+    const t37 = t34 ^ t36;
+    const t38 = t36 << 2;
+    const t39 = t35 & 0x33333333;
+    const t40 = t35 ^ t39;
+    const t41 = t39 << 2;
+    const t42 = t37 & 0x0f0f0f0f;
+    const t43 = t37 ^ t42;
+    const t44 = t42 << 4;
+    const t45 = t40 & 0x0f0f0f0f;
+    const t46 = t40 ^ t45;
+    const t47 = t45 << 4;
+    const t48 = t38 & 0x0f0f0f0f;
+    const t49 = t38 ^ t48;
+    const t50 = t48 << 4;
+    const t51 = t41 & 0x0f0f0f0f;
+    const t52 = t41 ^ t51;
+    const t53 = t51 << 4;
+    const t54 = t7 & 0x55555555;
+    const t55 = t7 ^ t54;
+    const t56 = t54 << 1;
+    const t57 = t55 & 0x33333333;
+    const t58 = t55 ^ t57;
+    const t59 = t57 << 2;
+    const t60 = t56 & 0x33333333;
+    const t61 = t56 ^ t60;
+    const t62 = t60 << 2;
+    const t63 = t58 & 0x0f0f0f0f;
+    const t64 = t58 ^ t63;
+    const t65 = t63 << 4;
+    const t66 = t61 & 0x0f0f0f0f;
+    const t67 = t61 ^ t66;
+    const t68 = t66 << 4;
+    const t69 = t59 & 0x0f0f0f0f;
+    const t70 = t59 ^ t69;
+    const t71 = t69 << 4;
+    const t72 = t62 & 0x0f0f0f0f;
+    const t73 = t62 ^ t72;
+    const t74 = t72 << 4;
+    const t75 = t10 & 0x55555555;
+    const t76 = t10 ^ t75;
+    const t77 = t75 << 1;
+    const t78 = t76 & 0x33333333;
+    const t79 = t76 ^ t78;
+    const t80 = t78 << 2;
+    const t81 = t77 & 0x33333333;
+    const t82 = t77 ^ t81;
+    const t83 = t81 << 2;
+    const t84 = t79 & 0x0f0f0f0f;
+    const t85 = t79 ^ t84;
+    const t86 = t84 << 4;
+    const t87 = t82 & 0x0f0f0f0f;
+    const t88 = t82 ^ t87;
+    const t89 = t87 << 4;
+    const t90 = t80 & 0x0f0f0f0f;
+    const t91 = t80 ^ t90;
+    const t92 = t90 << 4;
+    const t93 = t83 & 0x0f0f0f0f;
+    const t94 = t83 ^ t93;
+    const t95 = t93 << 4;
+    out[0] = t22;
+    out[1] = t43;
+    out[2] = t64;
+    out[3] = t85;
+    out[4] = t25;
+    out[5] = t46;
+    out[6] = t67;
+    out[7] = t88;
+    out[8] = t28;
+    out[9] = t49;
+    out[10] = t70;
+    out[11] = t91;
+    out[12] = t31;
+    out[13] = t52;
+    out[14] = t73;
+    out[15] = t94;
+    out[16] = t23;
+    out[17] = t44;
+    out[18] = t65;
+    out[19] = t86;
+    out[20] = t26;
+    out[21] = t47;
+    out[22] = t68;
+    out[23] = t89;
+    out[24] = t29;
+    out[25] = t50;
+    out[26] = t71;
+    out[27] = t92;
+    out[28] = t32;
+    out[29] = t53;
+    out[30] = t74;
+    out[31] = t95;
 }
 /**
- * XOR two AES blocks: out = a ^ b
+ * AEGIS-128L keystream extraction from the packed state:
+ * z0 = S6 ^ S1 ^ (S2 & S3), z1 = S2 ^ S5 ^ (S6 & S7), computed lane-wise,
+ * then unpacked (unpack04 restricted to the words feeding blocks 0 and 4).
  */
-export function blockXor(out, a, b) {
-    out[0] = (a[0] ^ b[0]) >>> 0;
-    out[1] = (a[1] ^ b[1]) >>> 0;
-    out[2] = (a[2] ^ b[2]) >>> 0;
-    out[3] = (a[3] ^ b[3]) >>> 0;
+export function keystream128(st, z0, z1) {
+    const x0 = st[0];
+    const c0 = ((x0 & 0x02020202) << 6) ^
+        ((x0 & 0x40404040) << 1) ^
+        ((x0 & (x0 >>> 1) & 0x10101010) << 3) ^
+        ((x0 & 0x20202020) >>> 2) ^
+        ((x0 & 0x04040404) << 1) ^
+        ((x0 & (x0 >>> 1) & 0x01010101) << 3);
+    const x1 = st[1];
+    const c1 = ((x1 & 0x02020202) << 6) ^
+        ((x1 & 0x40404040) << 1) ^
+        ((x1 & (x1 >>> 1) & 0x10101010) << 3) ^
+        ((x1 & 0x20202020) >>> 2) ^
+        ((x1 & 0x04040404) << 1) ^
+        ((x1 & (x1 >>> 1) & 0x01010101) << 3);
+    const x2 = st[2];
+    const c2 = ((x2 & 0x02020202) << 6) ^
+        ((x2 & 0x40404040) << 1) ^
+        ((x2 & (x2 >>> 1) & 0x10101010) << 3) ^
+        ((x2 & 0x20202020) >>> 2) ^
+        ((x2 & 0x04040404) << 1) ^
+        ((x2 & (x2 >>> 1) & 0x01010101) << 3);
+    const x3 = st[3];
+    const c3 = ((x3 & 0x02020202) << 6) ^
+        ((x3 & 0x40404040) << 1) ^
+        ((x3 & (x3 >>> 1) & 0x10101010) << 3) ^
+        ((x3 & 0x20202020) >>> 2) ^
+        ((x3 & 0x04040404) << 1) ^
+        ((x3 & (x3 >>> 1) & 0x01010101) << 3);
+    const x4 = st[4];
+    const c4 = ((x4 & 0x02020202) << 6) ^
+        ((x4 & 0x40404040) << 1) ^
+        ((x4 & (x4 >>> 1) & 0x10101010) << 3) ^
+        ((x4 & 0x20202020) >>> 2) ^
+        ((x4 & 0x04040404) << 1) ^
+        ((x4 & (x4 >>> 1) & 0x01010101) << 3);
+    const x5 = st[5];
+    const c5 = ((x5 & 0x02020202) << 6) ^
+        ((x5 & 0x40404040) << 1) ^
+        ((x5 & (x5 >>> 1) & 0x10101010) << 3) ^
+        ((x5 & 0x20202020) >>> 2) ^
+        ((x5 & 0x04040404) << 1) ^
+        ((x5 & (x5 >>> 1) & 0x01010101) << 3);
+    const x6 = st[6];
+    const c6 = ((x6 & 0x02020202) << 6) ^
+        ((x6 & 0x40404040) << 1) ^
+        ((x6 & (x6 >>> 1) & 0x10101010) << 3) ^
+        ((x6 & 0x20202020) >>> 2) ^
+        ((x6 & 0x04040404) << 1) ^
+        ((x6 & (x6 >>> 1) & 0x01010101) << 3);
+    const x7 = st[7];
+    const c7 = ((x7 & 0x02020202) << 6) ^
+        ((x7 & 0x40404040) << 1) ^
+        ((x7 & (x7 >>> 1) & 0x10101010) << 3) ^
+        ((x7 & 0x20202020) >>> 2) ^
+        ((x7 & 0x04040404) << 1) ^
+        ((x7 & (x7 >>> 1) & 0x01010101) << 3);
+    const x8 = st[8];
+    const c8 = ((x8 & 0x02020202) << 6) ^
+        ((x8 & 0x40404040) << 1) ^
+        ((x8 & (x8 >>> 1) & 0x10101010) << 3) ^
+        ((x8 & 0x20202020) >>> 2) ^
+        ((x8 & 0x04040404) << 1) ^
+        ((x8 & (x8 >>> 1) & 0x01010101) << 3);
+    const x9 = st[9];
+    const c9 = ((x9 & 0x02020202) << 6) ^
+        ((x9 & 0x40404040) << 1) ^
+        ((x9 & (x9 >>> 1) & 0x10101010) << 3) ^
+        ((x9 & 0x20202020) >>> 2) ^
+        ((x9 & 0x04040404) << 1) ^
+        ((x9 & (x9 >>> 1) & 0x01010101) << 3);
+    const x10 = st[10];
+    const c10 = ((x10 & 0x02020202) << 6) ^
+        ((x10 & 0x40404040) << 1) ^
+        ((x10 & (x10 >>> 1) & 0x10101010) << 3) ^
+        ((x10 & 0x20202020) >>> 2) ^
+        ((x10 & 0x04040404) << 1) ^
+        ((x10 & (x10 >>> 1) & 0x01010101) << 3);
+    const x11 = st[11];
+    const c11 = ((x11 & 0x02020202) << 6) ^
+        ((x11 & 0x40404040) << 1) ^
+        ((x11 & (x11 >>> 1) & 0x10101010) << 3) ^
+        ((x11 & 0x20202020) >>> 2) ^
+        ((x11 & 0x04040404) << 1) ^
+        ((x11 & (x11 >>> 1) & 0x01010101) << 3);
+    const x12 = st[12];
+    const c12 = ((x12 & 0x02020202) << 6) ^
+        ((x12 & 0x40404040) << 1) ^
+        ((x12 & (x12 >>> 1) & 0x10101010) << 3) ^
+        ((x12 & 0x20202020) >>> 2) ^
+        ((x12 & 0x04040404) << 1) ^
+        ((x12 & (x12 >>> 1) & 0x01010101) << 3);
+    const x13 = st[13];
+    const c13 = ((x13 & 0x02020202) << 6) ^
+        ((x13 & 0x40404040) << 1) ^
+        ((x13 & (x13 >>> 1) & 0x10101010) << 3) ^
+        ((x13 & 0x20202020) >>> 2) ^
+        ((x13 & 0x04040404) << 1) ^
+        ((x13 & (x13 >>> 1) & 0x01010101) << 3);
+    const x14 = st[14];
+    const c14 = ((x14 & 0x02020202) << 6) ^
+        ((x14 & 0x40404040) << 1) ^
+        ((x14 & (x14 >>> 1) & 0x10101010) << 3) ^
+        ((x14 & 0x20202020) >>> 2) ^
+        ((x14 & 0x04040404) << 1) ^
+        ((x14 & (x14 >>> 1) & 0x01010101) << 3);
+    const x15 = st[15];
+    const c15 = ((x15 & 0x02020202) << 6) ^
+        ((x15 & 0x40404040) << 1) ^
+        ((x15 & (x15 >>> 1) & 0x10101010) << 3) ^
+        ((x15 & 0x20202020) >>> 2) ^
+        ((x15 & 0x04040404) << 1) ^
+        ((x15 & (x15 >>> 1) & 0x01010101) << 3);
+    const x16 = st[16];
+    const c16 = ((x16 & 0x02020202) << 6) ^
+        ((x16 & 0x40404040) << 1) ^
+        ((x16 & (x16 >>> 1) & 0x10101010) << 3) ^
+        ((x16 & 0x20202020) >>> 2) ^
+        ((x16 & 0x04040404) << 1) ^
+        ((x16 & (x16 >>> 1) & 0x01010101) << 3);
+    const x17 = st[17];
+    const c17 = ((x17 & 0x02020202) << 6) ^
+        ((x17 & 0x40404040) << 1) ^
+        ((x17 & (x17 >>> 1) & 0x10101010) << 3) ^
+        ((x17 & 0x20202020) >>> 2) ^
+        ((x17 & 0x04040404) << 1) ^
+        ((x17 & (x17 >>> 1) & 0x01010101) << 3);
+    const x18 = st[18];
+    const c18 = ((x18 & 0x02020202) << 6) ^
+        ((x18 & 0x40404040) << 1) ^
+        ((x18 & (x18 >>> 1) & 0x10101010) << 3) ^
+        ((x18 & 0x20202020) >>> 2) ^
+        ((x18 & 0x04040404) << 1) ^
+        ((x18 & (x18 >>> 1) & 0x01010101) << 3);
+    const x19 = st[19];
+    const c19 = ((x19 & 0x02020202) << 6) ^
+        ((x19 & 0x40404040) << 1) ^
+        ((x19 & (x19 >>> 1) & 0x10101010) << 3) ^
+        ((x19 & 0x20202020) >>> 2) ^
+        ((x19 & 0x04040404) << 1) ^
+        ((x19 & (x19 >>> 1) & 0x01010101) << 3);
+    const x20 = st[20];
+    const c20 = ((x20 & 0x02020202) << 6) ^
+        ((x20 & 0x40404040) << 1) ^
+        ((x20 & (x20 >>> 1) & 0x10101010) << 3) ^
+        ((x20 & 0x20202020) >>> 2) ^
+        ((x20 & 0x04040404) << 1) ^
+        ((x20 & (x20 >>> 1) & 0x01010101) << 3);
+    const x21 = st[21];
+    const c21 = ((x21 & 0x02020202) << 6) ^
+        ((x21 & 0x40404040) << 1) ^
+        ((x21 & (x21 >>> 1) & 0x10101010) << 3) ^
+        ((x21 & 0x20202020) >>> 2) ^
+        ((x21 & 0x04040404) << 1) ^
+        ((x21 & (x21 >>> 1) & 0x01010101) << 3);
+    const x22 = st[22];
+    const c22 = ((x22 & 0x02020202) << 6) ^
+        ((x22 & 0x40404040) << 1) ^
+        ((x22 & (x22 >>> 1) & 0x10101010) << 3) ^
+        ((x22 & 0x20202020) >>> 2) ^
+        ((x22 & 0x04040404) << 1) ^
+        ((x22 & (x22 >>> 1) & 0x01010101) << 3);
+    const x23 = st[23];
+    const c23 = ((x23 & 0x02020202) << 6) ^
+        ((x23 & 0x40404040) << 1) ^
+        ((x23 & (x23 >>> 1) & 0x10101010) << 3) ^
+        ((x23 & 0x20202020) >>> 2) ^
+        ((x23 & 0x04040404) << 1) ^
+        ((x23 & (x23 >>> 1) & 0x01010101) << 3);
+    const x24 = st[24];
+    const c24 = ((x24 & 0x02020202) << 6) ^
+        ((x24 & 0x40404040) << 1) ^
+        ((x24 & (x24 >>> 1) & 0x10101010) << 3) ^
+        ((x24 & 0x20202020) >>> 2) ^
+        ((x24 & 0x04040404) << 1) ^
+        ((x24 & (x24 >>> 1) & 0x01010101) << 3);
+    const x25 = st[25];
+    const c25 = ((x25 & 0x02020202) << 6) ^
+        ((x25 & 0x40404040) << 1) ^
+        ((x25 & (x25 >>> 1) & 0x10101010) << 3) ^
+        ((x25 & 0x20202020) >>> 2) ^
+        ((x25 & 0x04040404) << 1) ^
+        ((x25 & (x25 >>> 1) & 0x01010101) << 3);
+    const x26 = st[26];
+    const c26 = ((x26 & 0x02020202) << 6) ^
+        ((x26 & 0x40404040) << 1) ^
+        ((x26 & (x26 >>> 1) & 0x10101010) << 3) ^
+        ((x26 & 0x20202020) >>> 2) ^
+        ((x26 & 0x04040404) << 1) ^
+        ((x26 & (x26 >>> 1) & 0x01010101) << 3);
+    const x27 = st[27];
+    const c27 = ((x27 & 0x02020202) << 6) ^
+        ((x27 & 0x40404040) << 1) ^
+        ((x27 & (x27 >>> 1) & 0x10101010) << 3) ^
+        ((x27 & 0x20202020) >>> 2) ^
+        ((x27 & 0x04040404) << 1) ^
+        ((x27 & (x27 >>> 1) & 0x01010101) << 3);
+    const x28 = st[28];
+    const c28 = ((x28 & 0x02020202) << 6) ^
+        ((x28 & 0x40404040) << 1) ^
+        ((x28 & (x28 >>> 1) & 0x10101010) << 3) ^
+        ((x28 & 0x20202020) >>> 2) ^
+        ((x28 & 0x04040404) << 1) ^
+        ((x28 & (x28 >>> 1) & 0x01010101) << 3);
+    const x29 = st[29];
+    const c29 = ((x29 & 0x02020202) << 6) ^
+        ((x29 & 0x40404040) << 1) ^
+        ((x29 & (x29 >>> 1) & 0x10101010) << 3) ^
+        ((x29 & 0x20202020) >>> 2) ^
+        ((x29 & 0x04040404) << 1) ^
+        ((x29 & (x29 >>> 1) & 0x01010101) << 3);
+    const x30 = st[30];
+    const c30 = ((x30 & 0x02020202) << 6) ^
+        ((x30 & 0x40404040) << 1) ^
+        ((x30 & (x30 >>> 1) & 0x10101010) << 3) ^
+        ((x30 & 0x20202020) >>> 2) ^
+        ((x30 & 0x04040404) << 1) ^
+        ((x30 & (x30 >>> 1) & 0x01010101) << 3);
+    const x31 = st[31];
+    const c31 = ((x31 & 0x02020202) << 6) ^
+        ((x31 & 0x40404040) << 1) ^
+        ((x31 & (x31 >>> 1) & 0x10101010) << 3) ^
+        ((x31 & 0x20202020) >>> 2) ^
+        ((x31 & 0x04040404) << 1) ^
+        ((x31 & (x31 >>> 1) & 0x01010101) << 3);
+    const t0 = (c12 ^ (c28 >>> 4)) & 0x0f0f0f0f;
+    const t1 = c12 ^ t0;
+    const t2 = c28 ^ (t0 << 4);
+    const t3 = (c8 ^ (c24 >>> 4)) & 0x0f0f0f0f;
+    const t4 = c8 ^ t3;
+    const t5 = c24 ^ (t3 << 4);
+    const t6 = (c4 ^ (c20 >>> 4)) & 0x0f0f0f0f;
+    const t7 = c4 ^ t6;
+    const t8 = c20 ^ (t6 << 4);
+    const t9 = (c0 ^ (c16 >>> 4)) & 0x0f0f0f0f;
+    const t10 = c0 ^ t9;
+    const t11 = c16 ^ (t9 << 4);
+    const t12 = (t8 ^ (t2 >>> 2)) & 0x33333333;
+    const t13 = t8 ^ t12;
+    const t14 = (t11 ^ (t5 >>> 2)) & 0x33333333;
+    const t15 = t11 ^ t14;
+    const t16 = (t7 ^ (t1 >>> 2)) & 0x33333333;
+    const t17 = t7 ^ t16;
+    const t18 = (t10 ^ (t4 >>> 2)) & 0x33333333;
+    const t19 = t10 ^ t18;
+    const t20 = (t15 ^ (t13 >>> 1)) & 0x55555555;
+    const t21 = t15 ^ t20;
+    const t22 = (t19 ^ (t17 >>> 1)) & 0x55555555;
+    const t23 = t19 ^ t22;
+    const t24 = (c13 ^ (c29 >>> 4)) & 0x0f0f0f0f;
+    const t25 = c13 ^ t24;
+    const t26 = c29 ^ (t24 << 4);
+    const t27 = (c9 ^ (c25 >>> 4)) & 0x0f0f0f0f;
+    const t28 = c9 ^ t27;
+    const t29 = c25 ^ (t27 << 4);
+    const t30 = (c5 ^ (c21 >>> 4)) & 0x0f0f0f0f;
+    const t31 = c5 ^ t30;
+    const t32 = c21 ^ (t30 << 4);
+    const t33 = (c1 ^ (c17 >>> 4)) & 0x0f0f0f0f;
+    const t34 = c1 ^ t33;
+    const t35 = c17 ^ (t33 << 4);
+    const t36 = (t32 ^ (t26 >>> 2)) & 0x33333333;
+    const t37 = t32 ^ t36;
+    const t38 = (t35 ^ (t29 >>> 2)) & 0x33333333;
+    const t39 = t35 ^ t38;
+    const t40 = (t31 ^ (t25 >>> 2)) & 0x33333333;
+    const t41 = t31 ^ t40;
+    const t42 = (t34 ^ (t28 >>> 2)) & 0x33333333;
+    const t43 = t34 ^ t42;
+    const t44 = (t39 ^ (t37 >>> 1)) & 0x55555555;
+    const t45 = t39 ^ t44;
+    const t46 = (t43 ^ (t41 >>> 1)) & 0x55555555;
+    const t47 = t43 ^ t46;
+    const t48 = (c14 ^ (c30 >>> 4)) & 0x0f0f0f0f;
+    const t49 = c14 ^ t48;
+    const t50 = c30 ^ (t48 << 4);
+    const t51 = (c10 ^ (c26 >>> 4)) & 0x0f0f0f0f;
+    const t52 = c10 ^ t51;
+    const t53 = c26 ^ (t51 << 4);
+    const t54 = (c6 ^ (c22 >>> 4)) & 0x0f0f0f0f;
+    const t55 = c6 ^ t54;
+    const t56 = c22 ^ (t54 << 4);
+    const t57 = (c2 ^ (c18 >>> 4)) & 0x0f0f0f0f;
+    const t58 = c2 ^ t57;
+    const t59 = c18 ^ (t57 << 4);
+    const t60 = (t56 ^ (t50 >>> 2)) & 0x33333333;
+    const t61 = t56 ^ t60;
+    const t62 = (t59 ^ (t53 >>> 2)) & 0x33333333;
+    const t63 = t59 ^ t62;
+    const t64 = (t55 ^ (t49 >>> 2)) & 0x33333333;
+    const t65 = t55 ^ t64;
+    const t66 = (t58 ^ (t52 >>> 2)) & 0x33333333;
+    const t67 = t58 ^ t66;
+    const t68 = (t63 ^ (t61 >>> 1)) & 0x55555555;
+    const t69 = t63 ^ t68;
+    const t70 = (t67 ^ (t65 >>> 1)) & 0x55555555;
+    const t71 = t67 ^ t70;
+    const t72 = (c15 ^ (c31 >>> 4)) & 0x0f0f0f0f;
+    const t73 = c15 ^ t72;
+    const t74 = c31 ^ (t72 << 4);
+    const t75 = (c11 ^ (c27 >>> 4)) & 0x0f0f0f0f;
+    const t76 = c11 ^ t75;
+    const t77 = c27 ^ (t75 << 4);
+    const t78 = (c7 ^ (c23 >>> 4)) & 0x0f0f0f0f;
+    const t79 = c7 ^ t78;
+    const t80 = c23 ^ (t78 << 4);
+    const t81 = (c3 ^ (c19 >>> 4)) & 0x0f0f0f0f;
+    const t82 = c3 ^ t81;
+    const t83 = c19 ^ (t81 << 4);
+    const t84 = (t80 ^ (t74 >>> 2)) & 0x33333333;
+    const t85 = t80 ^ t84;
+    const t86 = (t83 ^ (t77 >>> 2)) & 0x33333333;
+    const t87 = t83 ^ t86;
+    const t88 = (t79 ^ (t73 >>> 2)) & 0x33333333;
+    const t89 = t79 ^ t88;
+    const t90 = (t82 ^ (t76 >>> 2)) & 0x33333333;
+    const t91 = t82 ^ t90;
+    const t92 = (t87 ^ (t85 >>> 1)) & 0x55555555;
+    const t93 = t87 ^ t92;
+    const t94 = (t91 ^ (t89 >>> 1)) & 0x55555555;
+    const t95 = t91 ^ t94;
+    const t96 = (t93 ^ (t45 >>> 16)) & 0x0000ffff;
+    const t97 = t93 ^ t96;
+    const t98 = t45 ^ (t96 << 16);
+    const t99 = (t95 ^ (t47 >>> 16)) & 0x0000ffff;
+    const t100 = t95 ^ t99;
+    const t101 = t47 ^ (t99 << 16);
+    const t102 = (t69 ^ (t21 >>> 16)) & 0x0000ffff;
+    const t103 = t69 ^ t102;
+    const t104 = t21 ^ (t102 << 16);
+    const t105 = (t71 ^ (t23 >>> 16)) & 0x0000ffff;
+    const t106 = t71 ^ t105;
+    const t107 = t23 ^ (t105 << 16);
+    const t108 = (t97 ^ (t103 >>> 8)) & 0x00ff00ff;
+    const t109 = t97 ^ t108;
+    const t110 = t103 ^ (t108 << 8);
+    const t111 = (t98 ^ (t104 >>> 8)) & 0x00ff00ff;
+    const t112 = t98 ^ t111;
+    const t113 = t104 ^ (t111 << 8);
+    const t114 = (t100 ^ (t106 >>> 8)) & 0x00ff00ff;
+    const t115 = t100 ^ t114;
+    const t116 = t106 ^ (t114 << 8);
+    const t117 = (t101 ^ (t107 >>> 8)) & 0x00ff00ff;
+    const t118 = t101 ^ t117;
+    const t119 = t107 ^ (t117 << 8);
+    z0[0] = t119;
+    z0[1] = t118;
+    z0[2] = t116;
+    z0[3] = t115;
+    z1[0] = t113;
+    z1[1] = t112;
+    z1[2] = t110;
+    z1[3] = t109;
 }
 /**
- * XOR two bitsliced states: a ^= b
+ * AEGIS-256 keystream extraction from the packed state:
+ * z = S1 ^ S4 ^ S5 ^ (S2 & S3), computed lane-wise, then unpacked
+ * (unpack04_6 restricted to the words feeding block 0).
  */
-export function blocksXor(a, b) {
-    for (let i = 0; i < 32; i++) {
-        a[i] = (a[i] ^ b[i]) >>> 0;
-    }
+export function keystream256(st, z) {
+    const x0 = st[0];
+    const c0 = ((x0 & 0x40404040) << 1) ^
+        ((x0 & 0x08080808) << 4) ^
+        ((x0 & 0x04040404) << 5) ^
+        ((x0 & (x0 >>> 1) & 0x10101010) << 3);
+    const x1 = st[1];
+    const c1 = ((x1 & 0x40404040) << 1) ^
+        ((x1 & 0x08080808) << 4) ^
+        ((x1 & 0x04040404) << 5) ^
+        ((x1 & (x1 >>> 1) & 0x10101010) << 3);
+    const x2 = st[2];
+    const c2 = ((x2 & 0x40404040) << 1) ^
+        ((x2 & 0x08080808) << 4) ^
+        ((x2 & 0x04040404) << 5) ^
+        ((x2 & (x2 >>> 1) & 0x10101010) << 3);
+    const x3 = st[3];
+    const c3 = ((x3 & 0x40404040) << 1) ^
+        ((x3 & 0x08080808) << 4) ^
+        ((x3 & 0x04040404) << 5) ^
+        ((x3 & (x3 >>> 1) & 0x10101010) << 3);
+    const x4 = st[4];
+    const c4 = ((x4 & 0x40404040) << 1) ^
+        ((x4 & 0x08080808) << 4) ^
+        ((x4 & 0x04040404) << 5) ^
+        ((x4 & (x4 >>> 1) & 0x10101010) << 3);
+    const x5 = st[5];
+    const c5 = ((x5 & 0x40404040) << 1) ^
+        ((x5 & 0x08080808) << 4) ^
+        ((x5 & 0x04040404) << 5) ^
+        ((x5 & (x5 >>> 1) & 0x10101010) << 3);
+    const x6 = st[6];
+    const c6 = ((x6 & 0x40404040) << 1) ^
+        ((x6 & 0x08080808) << 4) ^
+        ((x6 & 0x04040404) << 5) ^
+        ((x6 & (x6 >>> 1) & 0x10101010) << 3);
+    const x7 = st[7];
+    const c7 = ((x7 & 0x40404040) << 1) ^
+        ((x7 & 0x08080808) << 4) ^
+        ((x7 & 0x04040404) << 5) ^
+        ((x7 & (x7 >>> 1) & 0x10101010) << 3);
+    const x8 = st[8];
+    const c8 = ((x8 & 0x40404040) << 1) ^
+        ((x8 & 0x08080808) << 4) ^
+        ((x8 & 0x04040404) << 5) ^
+        ((x8 & (x8 >>> 1) & 0x10101010) << 3);
+    const x9 = st[9];
+    const c9 = ((x9 & 0x40404040) << 1) ^
+        ((x9 & 0x08080808) << 4) ^
+        ((x9 & 0x04040404) << 5) ^
+        ((x9 & (x9 >>> 1) & 0x10101010) << 3);
+    const x10 = st[10];
+    const c10 = ((x10 & 0x40404040) << 1) ^
+        ((x10 & 0x08080808) << 4) ^
+        ((x10 & 0x04040404) << 5) ^
+        ((x10 & (x10 >>> 1) & 0x10101010) << 3);
+    const x11 = st[11];
+    const c11 = ((x11 & 0x40404040) << 1) ^
+        ((x11 & 0x08080808) << 4) ^
+        ((x11 & 0x04040404) << 5) ^
+        ((x11 & (x11 >>> 1) & 0x10101010) << 3);
+    const x12 = st[12];
+    const c12 = ((x12 & 0x40404040) << 1) ^
+        ((x12 & 0x08080808) << 4) ^
+        ((x12 & 0x04040404) << 5) ^
+        ((x12 & (x12 >>> 1) & 0x10101010) << 3);
+    const x13 = st[13];
+    const c13 = ((x13 & 0x40404040) << 1) ^
+        ((x13 & 0x08080808) << 4) ^
+        ((x13 & 0x04040404) << 5) ^
+        ((x13 & (x13 >>> 1) & 0x10101010) << 3);
+    const x14 = st[14];
+    const c14 = ((x14 & 0x40404040) << 1) ^
+        ((x14 & 0x08080808) << 4) ^
+        ((x14 & 0x04040404) << 5) ^
+        ((x14 & (x14 >>> 1) & 0x10101010) << 3);
+    const x15 = st[15];
+    const c15 = ((x15 & 0x40404040) << 1) ^
+        ((x15 & 0x08080808) << 4) ^
+        ((x15 & 0x04040404) << 5) ^
+        ((x15 & (x15 >>> 1) & 0x10101010) << 3);
+    const x16 = st[16];
+    const c16 = ((x16 & 0x40404040) << 1) ^
+        ((x16 & 0x08080808) << 4) ^
+        ((x16 & 0x04040404) << 5) ^
+        ((x16 & (x16 >>> 1) & 0x10101010) << 3);
+    const x17 = st[17];
+    const c17 = ((x17 & 0x40404040) << 1) ^
+        ((x17 & 0x08080808) << 4) ^
+        ((x17 & 0x04040404) << 5) ^
+        ((x17 & (x17 >>> 1) & 0x10101010) << 3);
+    const x18 = st[18];
+    const c18 = ((x18 & 0x40404040) << 1) ^
+        ((x18 & 0x08080808) << 4) ^
+        ((x18 & 0x04040404) << 5) ^
+        ((x18 & (x18 >>> 1) & 0x10101010) << 3);
+    const x19 = st[19];
+    const c19 = ((x19 & 0x40404040) << 1) ^
+        ((x19 & 0x08080808) << 4) ^
+        ((x19 & 0x04040404) << 5) ^
+        ((x19 & (x19 >>> 1) & 0x10101010) << 3);
+    const x20 = st[20];
+    const c20 = ((x20 & 0x40404040) << 1) ^
+        ((x20 & 0x08080808) << 4) ^
+        ((x20 & 0x04040404) << 5) ^
+        ((x20 & (x20 >>> 1) & 0x10101010) << 3);
+    const x21 = st[21];
+    const c21 = ((x21 & 0x40404040) << 1) ^
+        ((x21 & 0x08080808) << 4) ^
+        ((x21 & 0x04040404) << 5) ^
+        ((x21 & (x21 >>> 1) & 0x10101010) << 3);
+    const x22 = st[22];
+    const c22 = ((x22 & 0x40404040) << 1) ^
+        ((x22 & 0x08080808) << 4) ^
+        ((x22 & 0x04040404) << 5) ^
+        ((x22 & (x22 >>> 1) & 0x10101010) << 3);
+    const x23 = st[23];
+    const c23 = ((x23 & 0x40404040) << 1) ^
+        ((x23 & 0x08080808) << 4) ^
+        ((x23 & 0x04040404) << 5) ^
+        ((x23 & (x23 >>> 1) & 0x10101010) << 3);
+    const x24 = st[24];
+    const c24 = ((x24 & 0x40404040) << 1) ^
+        ((x24 & 0x08080808) << 4) ^
+        ((x24 & 0x04040404) << 5) ^
+        ((x24 & (x24 >>> 1) & 0x10101010) << 3);
+    const x25 = st[25];
+    const c25 = ((x25 & 0x40404040) << 1) ^
+        ((x25 & 0x08080808) << 4) ^
+        ((x25 & 0x04040404) << 5) ^
+        ((x25 & (x25 >>> 1) & 0x10101010) << 3);
+    const x26 = st[26];
+    const c26 = ((x26 & 0x40404040) << 1) ^
+        ((x26 & 0x08080808) << 4) ^
+        ((x26 & 0x04040404) << 5) ^
+        ((x26 & (x26 >>> 1) & 0x10101010) << 3);
+    const x27 = st[27];
+    const c27 = ((x27 & 0x40404040) << 1) ^
+        ((x27 & 0x08080808) << 4) ^
+        ((x27 & 0x04040404) << 5) ^
+        ((x27 & (x27 >>> 1) & 0x10101010) << 3);
+    const x28 = st[28];
+    const c28 = ((x28 & 0x40404040) << 1) ^
+        ((x28 & 0x08080808) << 4) ^
+        ((x28 & 0x04040404) << 5) ^
+        ((x28 & (x28 >>> 1) & 0x10101010) << 3);
+    const x29 = st[29];
+    const c29 = ((x29 & 0x40404040) << 1) ^
+        ((x29 & 0x08080808) << 4) ^
+        ((x29 & 0x04040404) << 5) ^
+        ((x29 & (x29 >>> 1) & 0x10101010) << 3);
+    const x30 = st[30];
+    const c30 = ((x30 & 0x40404040) << 1) ^
+        ((x30 & 0x08080808) << 4) ^
+        ((x30 & 0x04040404) << 5) ^
+        ((x30 & (x30 >>> 1) & 0x10101010) << 3);
+    const x31 = st[31];
+    const c31 = ((x31 & 0x40404040) << 1) ^
+        ((x31 & 0x08080808) << 4) ^
+        ((x31 & 0x04040404) << 5) ^
+        ((x31 & (x31 >>> 1) & 0x10101010) << 3);
+    const t0 = (c12 ^ (c28 >>> 4)) & 0x0f0f0f0f;
+    const t1 = c12 ^ t0;
+    const t2 = (c8 ^ (c24 >>> 4)) & 0x0f0f0f0f;
+    const t3 = c8 ^ t2;
+    const t4 = (c4 ^ (c20 >>> 4)) & 0x0f0f0f0f;
+    const t5 = c4 ^ t4;
+    const t6 = (c0 ^ (c16 >>> 4)) & 0x0f0f0f0f;
+    const t7 = c0 ^ t6;
+    const t8 = (t5 ^ (t1 >>> 2)) & 0x33333333;
+    const t9 = t5 ^ t8;
+    const t10 = (t7 ^ (t3 >>> 2)) & 0x33333333;
+    const t11 = t7 ^ t10;
+    const t12 = (t11 ^ (t9 >>> 1)) & 0x55555555;
+    const t13 = t11 ^ t12;
+    const t14 = (c13 ^ (c29 >>> 4)) & 0x0f0f0f0f;
+    const t15 = c13 ^ t14;
+    const t16 = (c9 ^ (c25 >>> 4)) & 0x0f0f0f0f;
+    const t17 = c9 ^ t16;
+    const t18 = (c5 ^ (c21 >>> 4)) & 0x0f0f0f0f;
+    const t19 = c5 ^ t18;
+    const t20 = (c1 ^ (c17 >>> 4)) & 0x0f0f0f0f;
+    const t21 = c1 ^ t20;
+    const t22 = (t19 ^ (t15 >>> 2)) & 0x33333333;
+    const t23 = t19 ^ t22;
+    const t24 = (t21 ^ (t17 >>> 2)) & 0x33333333;
+    const t25 = t21 ^ t24;
+    const t26 = (t25 ^ (t23 >>> 1)) & 0x55555555;
+    const t27 = t25 ^ t26;
+    const t28 = (c14 ^ (c30 >>> 4)) & 0x0f0f0f0f;
+    const t29 = c14 ^ t28;
+    const t30 = (c10 ^ (c26 >>> 4)) & 0x0f0f0f0f;
+    const t31 = c10 ^ t30;
+    const t32 = (c6 ^ (c22 >>> 4)) & 0x0f0f0f0f;
+    const t33 = c6 ^ t32;
+    const t34 = (c2 ^ (c18 >>> 4)) & 0x0f0f0f0f;
+    const t35 = c2 ^ t34;
+    const t36 = (t33 ^ (t29 >>> 2)) & 0x33333333;
+    const t37 = t33 ^ t36;
+    const t38 = (t35 ^ (t31 >>> 2)) & 0x33333333;
+    const t39 = t35 ^ t38;
+    const t40 = (t39 ^ (t37 >>> 1)) & 0x55555555;
+    const t41 = t39 ^ t40;
+    const t42 = (c15 ^ (c31 >>> 4)) & 0x0f0f0f0f;
+    const t43 = c15 ^ t42;
+    const t44 = (c11 ^ (c27 >>> 4)) & 0x0f0f0f0f;
+    const t45 = c11 ^ t44;
+    const t46 = (c7 ^ (c23 >>> 4)) & 0x0f0f0f0f;
+    const t47 = c7 ^ t46;
+    const t48 = (c3 ^ (c19 >>> 4)) & 0x0f0f0f0f;
+    const t49 = c3 ^ t48;
+    const t50 = (t47 ^ (t43 >>> 2)) & 0x33333333;
+    const t51 = t47 ^ t50;
+    const t52 = (t49 ^ (t45 >>> 2)) & 0x33333333;
+    const t53 = t49 ^ t52;
+    const t54 = (t53 ^ (t51 >>> 1)) & 0x55555555;
+    const t55 = t53 ^ t54;
+    const t56 = (t55 ^ (t27 >>> 16)) & 0x0000ffff;
+    const t57 = t55 ^ t56;
+    const t58 = t27 ^ (t56 << 16);
+    const t59 = (t41 ^ (t13 >>> 16)) & 0x0000ffff;
+    const t60 = t41 ^ t59;
+    const t61 = t13 ^ (t59 << 16);
+    const t62 = (t57 ^ (t60 >>> 8)) & 0x00ff00ff;
+    const t63 = t57 ^ t62;
+    const t64 = t60 ^ (t62 << 8);
+    const t65 = (t58 ^ (t61 >>> 8)) & 0x00ff00ff;
+    const t66 = t58 ^ t65;
+    const t67 = t61 ^ (t65 << 8);
+    z[0] = t67;
+    z[1] = t66;
+    z[2] = t64;
+    z[3] = t63;
 }
-//# sourceMappingURL=aes-bs.js.map