“Finite Field Arithmetic.” Chapter 12A: Karatsuba Redux. (Part 1 of 2)

This article is part of a series of hands-on tutorials introducing FFA, or the Finite Field Arithmetic library. FFA differs from the typical “Open Sores” abomination, in that — rather than trusting the author blindly with their lives — prospective users are expected to read and fully understand every single line. In exactly the same manner that you would understand and pack your own parachute. The reader will assemble and test a working FFA with his own hands, and at the same time grasp the purpose of each moving part therein.

You will need:

  • A Keccak-based VTron (for this and all subsequent chapters.)
  • All of the materials from Chapters 1 – 11. (They have been re-ground for the new VTron format; please re-download here.)
  • There is no vpatch in Chapter 12A.

On account of the substantial heft of this chapter, I have cut it into two parts, 12A and 12B; you are presently reading 12A, which consists strictly of the benchmarks and detailed analysis of the Karatsuba method presented earlier. 12B will appear here in the course of the next several days, preceding Ch. 13.


First things first:

As noted earlier in Chapter 11:


And so I have carried out a benchmark battery strictly on Multiplication — naturally, on the standard test machine used for all previous benchmarks — across a meaningful range of FFA bitnesses (i.e. integers large enough not to fall through the resolution of the timer), across all of the multiplier routine variants offered in chapters 9 – 11:

Cost of 1000 Multiplication Operations, vs FFA Bitness.

Or, for those who prefer the raw numbers to the logarithmic plot,

Cost of 1000 Multiplication Operations (sec):
FFA Bitness Ch.9 “Soft” Comba Ch.9 “Iron” Comba Ch.10 Karatsuba (on Iron Comba) Ch.11 Karatsuba (on Iron Comba) with Inlining
2048 0.120 0.019 0.015 0.012
4096 0.480 0.074 0.046 0.035
8192 1.911 0.295 0.140 0.106
16384 7.638 1.170 0.427 0.328

The first item to discuss is that the introduction of ave1’s new Musl GNAT had no measurable effect on the performance of the compiled FFA code.

Therefore the above benchmark does not list separate measurements for the new and old GNATs, as they turned out to build executables which perform identically within the margin of error given by the timer resolution.

This is not a particularly surprising discovery, given as the new GNAT is largely the same as the GNAT I had been using previously, but for the fact that it builds on Musl rather than rotten old glibc. Given as FFA spends no substantial time in libc, this observation is not astonishing.

At the same time I will note that all subsequent FFA tests will be carried out on the new GNAT, and the reader is advised to build himself a working copy.

However, ave1’s inlining fix does have a measurable effect on performance: this is reflected in the smaller number of CPU cycles eaten by the FFA of Ch.11 compared to that of Ch.10.

The next item to discuss is the fact that the use of Mul_HalfWord_Soft in Word x Word multiplication imposes a substantial performance penalty.

Reader apeloyee was indeed correct: the slowdown was obscured in the modular exponentiation benchmark of Chapter 9 by the predominance of the modular reduction’s cost over that of multiplication’s. (This will be discussed in detail in Ch. 12B.)

On machines having a constant-time MUL instruction (e.g. AMD64) the use of “soft” Word x Word base case multiplication is an unnecessary sacrifice, and therefore the proclamation given in Chapter 9 is hereby withdrawn: people stuck with broken CPU architectures will be responsible for enabling the necessary workaround with their own hands, rather than imposing its cost on all FFA users.

At the conclusion of the FFA series, we will discuss a clean (i.e. via V-branches) means of offering the use of “soft” Word x Word multiplication on machines which require it, as well as a simple litmus test for the presence of a broken (i.e. one having a non-constant-time iron multiplier) CPU. But until then, all subsequent FFA benchmarks published here will presume the use of “Iron” Word x Word multiplication.

The last, and by far least surprising, observation concerning the benchmark is that Karatsuba multiplication is indeed faster (the exact runtime complexity of it — I will leave as an exercise for the reader) for sufficiently large integers, than the Ch. 9 O(N^2) Comba method (the latter remains in use, however, as the base case of Karatsuba.)


At this time we will walk through the mechanics of our Karatsuba multiplier, so as to cement in the reader’s head the correctness of the routine, and lay groundwork for the optimization which is introduced in Ch. 12B.

Let’s revisit the Karatsuba routine, as given in Chapter 11:

fz_mul.adb:

   -- ...
 
   -- Karatsuba's Multiplier. (CAUTION: UNBUFFERED)
   procedure Mul_Karatsuba(X  : in  FZ;
                           Y  : in  FZ;
                           XY : out FZ) is
 
      -- L is the wordness of a multiplicand. Guaranteed to be a power of two.
      L : constant Word_Count := X'Length;
 
      -- An 'LSeg' is the same length as either multiplicand.
      subtype LSeg is FZ(1 .. L);
 
      -- K is HALF of the length of a multiplicand.
      K : constant Word_Index := L / 2;
 
      -- A 'KSeg' is the same length as HALF of a multiplicand.
      subtype KSeg is FZ(1 .. K);
 
      -- The three L-sized variables of the product equation, i.e.:
      -- XY = LL + 2^(K*Bitness)(LL + HH + (-1^DD_Sub)*DD) + 2^(2*K*Bitness)HH
      LL, DD, HH : LSeg;
 
      -- K-sized terms of Dx * Dy = DD
      Dx, Dy     : KSeg;  -- Dx = abs(XLo - XHi) , Dy = abs(YLo - YHi)
 
      -- Subtraction borrows, signs of (XL - XH) and (YL - YH),
      Cx, Cy     : WBool; -- so that we can calculate (-1^DD_Sub)
 
      -- Bottom and Top K-sized halves of the multiplicand X.
      XLo        : KSeg  renames    X(  X'First       ..   X'Last - K );
      XHi        : KSeg  renames    X(  X'First + K   ..   X'Last     );
 
      -- Bottom and Top K-sized halves of the multiplicand Y.
      YLo        : KSeg  renames    Y(  Y'First       ..   Y'Last - K );
      YHi        : KSeg  renames    Y(  Y'First + K   ..   Y'Last     );
 
      -- L-sized middle segment of the product XY (+/- K from the midpoint).
      XYMid      : LSeg  renames   XY( XY'First + K   ..  XY'Last - K );
 
      -- Bottom and Top L-sized halves of the product XY.
      XYLo       : LSeg  renames   XY( XY'First       ..  XY'Last - L );
      XYHi       : LSeg  renames   XY( XY'First + L   ..  XY'Last     );
 
      -- Topmost K-sized quarter segment of the product XY, or 'tail'
      XYHiHi     : KSeg  renames XYHi( XYHi'First + K .. XYHi'Last    );
 
      -- Whether the DD term is being subtracted.
      DD_Sub     : WBool;
 
      -- Carry from individual term additions.
      C          : WBool;
 
      -- Tail-Carry accumulator, for the final ripple
      TC         : Word;
 
   begin
 
      -- Recurse: LL := XL * YL
      FZ_Multiply_Unbuffered(XLo, YLo, LL);
 
      -- Recurse: HH := XH * YH
      FZ_Multiply_Unbuffered(XHi, YHi, HH);
 
      -- Dx := |XL - XH| , Cx := Borrow (i.e. 1 iff XL < XH)
      FZ_Sub_Abs(X => XLo, Y => XHi, Difference => Dx, Underflow => Cx);
 
      -- Dy := |YL - YH| , Cy := Borrow (i.e. 1 iff YL < YH)
      FZ_Sub_Abs(X => YLo, Y => YHi, Difference => Dy, Underflow => Cy);
 
      -- Recurse: DD := Dx * Dy
      FZ_Multiply_Unbuffered(Dx, Dy, DD);
 
      -- Whether (XL - XH)(YL - YH) is positive, and so DD must be subtracted:
      DD_Sub := 1 - (Cx xor Cy);
 
      -- XY := LL + 2^(2 * K * Bitness) * HH
      XYLo := LL;
      XYHi := HH;
 
      -- XY += 2^(K * Bitness) * HH, but carry goes in Tail Carry accum.
      FZ_Add_D(X => XYMid, Y => HH, Overflow => TC);
 
      -- XY += 2^(K * Bitness) * LL, ...
      FZ_Add_D(X => XYMid, Y => LL, Overflow => C);
 
      -- ... but the carry goes into the Tail Carry accumulator.
      TC := TC + C;
 
      -- XY += 2^(K * Bitness) * (-1^DD_Sub) * DD
      FZ_Not_Cond_D(N => DD, Cond => DD_Sub); -- invert DD if 2s-complementing
      FZ_Add_D(OF_In    => DD_Sub,            -- ... and then must increment
               X        => XYMid,
               Y        => DD,
               Overflow => C); -- carry will go in Tail Carry accumulator
 
      -- Compute the final Tail Carry for the ripple
      TC := TC + C - DD_Sub;
 
      -- Barring a cosmic ray, 0 < = TC <= 2 .
      pragma Assert(TC <= 2);
 
      -- Ripple the Tail Carry into the tail.
      FZ_Add_D_W(X => XYHiHi, W => TC, Overflow => C);
 
      -- Barring a cosmic ray, the tail ripple will NOT overflow.
      pragma Assert(C = 0);
 
   end Mul_Karatsuba;
   -- CAUTION: Inlining prohibited for Mul_Karatsuba !
 
 
   -- Multiplier. (CAUTION: UNBUFFERED)
   procedure FZ_Multiply_Unbuffered(X     : in  FZ;
                                    Y     : in  FZ;
                                    XY    : out FZ) is
 
      -- The length of either multiplicand
      L : constant Word_Count := X'Length;
 
   begin
 
      if L < = Karatsuba_Thresh then
 
         -- Base case:
         FZ_Mul_Comba(X, Y, XY);
 
      else
 
         -- Recursive case:
         Mul_Karatsuba(X, Y, XY);
 
      end if;
 
   end FZ_Multiply_Unbuffered;

And now let’s step through the whole thing, in light of the arithmetical overview given in Chapter 10.

Recall that we derived the following equivalences for Karatsuba’s method:


LL = XLoYLo
HH = XHiYHi

Dx = |XLo - XHi|
Dy = |YLo - YHi|

DD = Dx × Dy

DDSub = CX XNOR CY

XY = LL + 2b(LL + HH + (-1DDSub)DD) + 22bHH

… where XLo and XHi are the bottom and top halves of the multiplicand X, respectively; YLo and YHi — of multiplicand Y; CX is the subtraction “borrow” resulting from the computation of Dx; and CY is same from the computation of Dy.

… and showed that the operation can be represented in the following “physical” form (junior bits of registers on left hand side, senior — on right hand) :

LL HH TC := 0
+ LL TC += Carry
+ HH TC += Carry
+ (-1DDSub)DD TC += Carry – DDSub
+ TC
= XY

Now let’s go through the routine itself and see which moving parts of the Ada program correspond to which pieces of the equivalence. And so, we begin at the beginning:

   -- Karatsuba's Multiplier. (CAUTION: UNBUFFERED)
   procedure Mul_Karatsuba(X  : in  FZ;
                           Y  : in  FZ;
                           XY : out FZ) is

X and Y, naturally, are the multiplicands; XY is the register to which the result of the multiplication is to be written. Observe that in the procedure's declaration:

fz_mul.ads:

   -- ...
   -- Karatsuba's Multiplier. (CAUTION: UNBUFFERED)
   procedure Mul_Karatsuba(X  : in  FZ;
                           Y  : in  FZ;
                           XY : out FZ)
     with Pre => X'Length = Y'Length and
     XY'Length = (X'Length + Y'Length) and
     X'Length mod 2 = 0;
   -- CAUTION: Inlining prohibited for Mul_Karatsuba !

... it is mandated that the length of XY must suffice to hold the resulting integer; and that the length of each multiplicand must be divisible by two. (Recall that valid FZ integers must in fact be of lengths which constitute powers of 2; the reason for this will become evident shortly.)

We have thereby obtained the "physical" representation shown earlier in Ch. 10:

XLo XHi
× YLo YHi
= XY

Let's proceed:

      -- L is the wordness of a multiplicand. Guaranteed to be a power of two.
      L : constant Word_Count := X'Length;
 
      -- An 'LSeg' is the same length as either multiplicand.
      subtype LSeg is FZ(1 .. L);

L is simply the length of either multiplicand (they are required, as shown in the declaration, to be of equal lengths.) K then corresponds to half of the length of a multiplicand; by breaking apart the multiplicands we will achieve the "divide and conquer" effect of Karatsuba's method, whereby we convert one multiplication of size 2K x 2K into three multiplications of size K x K.

Thereby L is the bit width of the

XLo XHi

... and

YLo YHi

... multiplicand registers; and as for K:

      -- K is HALF of the length of a multiplicand.
      K : constant Word_Index := L / 2;
 
      -- A 'KSeg' is the same length as HALF of a multiplicand.
      subtype KSeg is FZ(1 .. K);

K is the bit width of the low and high halves of the multiplicand registers, i.e. XLo, XHi, YLo, and YHi. Now we define the working registers for the intermediate terms in the equation:

      -- The three L-sized variables of the product equation, i.e.:
      -- XY = LL + 2^(K*Bitness)(LL + HH + (-1^DD_Sub)*DD) + 2^(2*K*Bitness)HH
      LL, DD, HH : LSeg;
 
      -- K-sized terms of Dx * Dy = DD
      Dx, Dy     : KSeg;  -- Dx = abs(XLo - XHi) , Dy = abs(YLo - YHi)

... let's also "draw to scale" all of these registers, and describe their desired eventual contents, referring to the earlier equivalences:


LL = XLoYLo

XLo
x YLo
LL


HH = XHiYHi

XHi
x YHi
HH


Dx = |XLo - XHi|

XLo
|-| XHi
=
Dx


Dy = |YLo - YHi|

YLo
|-| YHi
=
Dy


DD = Dx × Dy

Dx
x Dy
=
DD

Observe that DD is of width L, as FFA multiplication always results in an output having the summed width of the two multiplicands.

Now for Cx and Cy:

      -- Subtraction borrows, signs of (XL - XH) and (YL - YH),
      Cx, Cy     : WBool; -- so that we can calculate (-1^DD_Sub)

These are simply the borrows recorded from the computation of Dx and Dy, we will need them when computing DD_Sub later on. Moving on:

      -- Bottom and Top K-sized halves of the multiplicand X.
      XLo        : KSeg  renames    X(  X'First       ..   X'Last - K );
      XHi        : KSeg  renames    X(  X'First + K   ..   X'Last     );
 
      -- Bottom and Top K-sized halves of the multiplicand Y.
      YLo        : KSeg  renames    Y(  Y'First       ..   Y'Last - K );
      YHi        : KSeg  renames    Y(  Y'First + K   ..   Y'Last     );

We already described these, they are the upper and lower halves of X and Y, i.e. the multiplicands.

Now, the middle term, XYMid:

      -- L-sized middle segment of the product XY (+/- K from the midpoint).
      XYMid      : LSeg  renames   XY( XY'First + K   ..  XY'Last - K );

XYMid is where we will be putting... (ignore TC for now...)

+ LL TC += Carry
+ HH TC += Carry
+ (-1DDSub)DD TC += Carry - DDSub

... i.e. the "middle" terms. It represents a "slice" of the multiplication's output register XY. But in order to represent the first term of the equivalence,

LL HH TC := 0

... we will also need to represent top and bottom "slices" of the output XY:

      -- Bottom and Top L-sized halves of the product XY.
      XYLo       : LSeg  renames   XY( XY'First       ..  XY'Last - L );
      XYHi       : LSeg  renames   XY( XY'First + L   ..  XY'Last     );

Lastly, we will require a K-sized "slice" representation of XY, where we will be rippling out the accumulated "tail" carry, TC:

      -- Topmost K-sized quarter segment of the product XY, or 'tail'
      XYHiHi     : KSeg  renames XYHi( XYHi'First + K .. XYHi'Last    );
+ TC
= XY

... when we complete the computation of the product XY.

As for:

      -- Whether the DD term is being subtracted.
      DD_Sub     : WBool;
 
      -- Carry from individual term additions.
      C          : WBool;
 
      -- Tail-Carry accumulator, for the final ripple
      TC         : Word;

... we have already described them above, so let's:

   begin

And compute term LL:

      -- Recurse: LL := XL * YL
      FZ_Multiply_Unbuffered(XLo, YLo, LL);


LL = XLoYLo

XLo
x YLo
LL

... and then term HH:

      -- Recurse: HH := XH * YH
      FZ_Multiply_Unbuffered(XHi, YHi, HH);


HH = XHiYHi

XHi
x YHi
HH

Observe that we have begun to recurse: the invocations of multiplication may result in another Karatsubaization, or alternatively in an invocation of the Comba base case, depending on whether Karatsuba_Thresh is crossed; as specified in:

   -- Multiplier. (CAUTION: UNBUFFERED)
   procedure FZ_Multiply_Unbuffered(X     : in  FZ;
                                    Y     : in  FZ;
                                    XY    : out FZ) is
 
      -- The length of either multiplicand
      L : constant Word_Count := X'Length;
 
   begin
 
      if L < = Karatsuba_Thresh then
 
         -- Base case:
         FZ_Mul_Comba(X, Y, XY);
 
      else
 
         -- Recursive case:
         Mul_Karatsuba(X, Y, XY);
 
      end if;
 
   end FZ_Multiply_Unbuffered;

The constant for the base case transition was determined empirically, and its optimal value appears to be the same on all machine architectures. However, the reader is invited to carry out his own experiments.

We have performed out two of our three recursions; we now want Dx:


Dx = |XLo - XHi|

XLo
|-| XHi
=
Dx
      -- Dx := |XL - XH| , Cx := Borrow (i.e. 1 iff XL < XH)
      FZ_Sub_Abs(X => XLo, Y => XHi, Difference => Dx, Underflow => Cx);

... and Dy:


Dy = |YLo - YHi|

YLo
|-| YHi
=
Dy
      -- Dy := |YL - YH| , Cy := Borrow (i.e. 1 iff YL < YH)
      FZ_Sub_Abs(X => YLo, Y => YHi, Difference => Dy, Underflow => Cy);

It is now time to show how FZ_Sub_Abs works:

fz_arith.adb:

   -- Destructive: If Cond is 1, NotN := ~N; otherwise NotN := N.
   procedure FZ_Not_Cond_D(N    : in out FZ;
                           Cond : in     WBool)is
 
      -- The inversion mask
      Inv : constant Word := 0 - Cond;
 
   begin
 
      for i in N'Range loop
 
         -- Invert (or, if Cond is 0, do nothing)
         N(i) := N(i) xor Inv;
 
      end loop;
 
   end FZ_Not_Cond_D;
 
 
   -- Subtractor that gets absolute value if underflowed, in const. time
   procedure FZ_Sub_Abs(X          : in FZ;
                        Y          : in FZ;
                        Difference : out FZ;
                        Underflow  : out WBool) is
 
      O : Word := 0;
      pragma Unreferenced(O);
 
   begin
 
      -- First, we subtract normally
      FZ_Sub(X, Y, Difference, Underflow);
 
      -- If borrow - negate,
      FZ_Not_Cond_D(Difference, Underflow);
 
      -- ... and also increment.
      FZ_Add_D_W(Difference, Underflow, O);
 
   end FZ_Sub_Abs;

FZ_Sub_Abs is simply a constant-time means of taking the absolute value of a subtraction, and saving the output along with any resulting "borrow" bit for possible later use. Take careful note of the FZ_Not_Cond_D mechanism, you will be seeing it again shortly. The "D" stands for "Destructive" -- by this convention we refer to internal routines in FFA which operate "in-place", directly modifying their operand.

Moving on, we now want DD:


DD = Dx × Dy

Dx
x Dy
=
DD
      -- Recurse: DD := Dx * Dy
      FZ_Multiply_Unbuffered(Dx, Dy, DD);

And we got it -- with our third and final recursive call. Now we want DD_Sub:

      -- Whether (XL - XH)(YL - YH) is positive, and so DD must be subtracted:
      DD_Sub := 1 - (Cx xor Cy);

Why this is a valid equation for DD_Sub, is shown in a lemma in Chapter 10; please refer to it if memory fails you. Moving on to the upper and lower XY subterms,

LL HH TC := 0
      -- XY := LL + 2^(2 * K * Bitness) * HH
      XYLo := LL;
      XYHi := HH;

... and now let's begin to compute the middle term, XYMid:

+ LL TC += Carry
+ HH TC += Carry
      -- XY += 2^(K * Bitness) * HH, but carry goes in Tail Carry accum.
      FZ_Add_D(X => XYMid, Y => HH, Overflow => TC);
 
      -- XY += 2^(K * Bitness) * LL, ...
      FZ_Add_D(X => XYMid, Y => LL, Overflow => C);
 
      -- ... but the carry goes into the Tail Carry accumulator.
      TC := TC + C;

Observe that we accumulate the additions' carries in TC. But that's not all for the middle term, we also need the third subterm of it:

+ (-1DDSub)DD TC += Carry - DDSub

And we get it like this:

      -- XY += 2^(K * Bitness) * (-1^DD_Sub) * DD
      FZ_Not_Cond_D(N => DD, Cond => DD_Sub); -- invert DD if 2s-complementing
      FZ_Add_D(OF_In    => DD_Sub,            -- ... and then must increment
               X        => XYMid,
               Y        => DD,
               Overflow => C); -- carry will go in Tail Carry accumulator

We have already described FZ_Not_Cond_D; now it is necessary to review FZ_Add_D:

fz_arith.adb:

   -- Destructive Add: X := X + Y; Overflow := Carry; optional OF_In
   procedure FZ_Add_D(X          : in out FZ;
                      Y          : in     FZ;
                      Overflow   : out    WBool;
                      OF_In      : in     WBool := 0) is
      Carry : WBool := OF_In;
   begin
      for i in 0 .. Word_Index(X'Length - 1) loop
         declare
            A : constant Word := X(X'First + i);
            B : constant Word := Y(Y'First + i);
            S : constant Word := A + B + Carry;
         begin
            X(X'First + i) := S;
            Carry          := W_Carry(A, B, S);
         end;
      end loop;
      Overflow := Carry;
   end FZ_Add_D;

This is simply "in-place" addition, economizing on stack space and CPU cycles by avoiding the use of an intermediate scratch register. Note that the mechanism is entirely agnostic of the particular element enumeration of the operand arrays -- this is required because we are operating on array slices, on which Ada wisely preserves the parent array's indexing.

Now we will compute the final "tail carry", TC, and ripple it into the final output of the multiplication, XY:

+ TC
= XY
      -- Compute the final Tail Carry for the ripple
      TC := TC + C - DD_Sub;
 
      -- Barring a cosmic ray, 0 < = TC <= 2 .
      pragma Assert(TC <= 2);
 
      -- Ripple the Tail Carry into the tail.
      FZ_Add_D_W(X => XYHiHi, W => TC, Overflow => C);
 
      -- Barring a cosmic ray, the tail ripple will NOT overflow.
      pragma Assert(C = 0);

The proof regarding the validity of the ripple equation is given in Chapter 10, the reader is again asked to review it if the correctness of the given mechanism is not obvious to him.

Observe that we take a "belt and suspenders" approach regarding the correct operation of the carry ripple mechanism. Conceivably the asserts may be omitted in a speed-critical application; but their cost appears to be too small to measure on my system, and so they are to remain in the canonical version of FFA.

And, lastly,

   end Mul_Karatsuba;
   -- CAUTION: Inlining prohibited for Mul_Karatsuba !

... naturally it is not permissible to inline a Karatsuba invocation, as the procedure is recursive.

We have now obtained the entire "sandwich" from earlier:

LL HH TC := 0
+ LL TC += Carry
+ HH TC += Carry
+ (-1DDSub)DD TC += Carry - DDSub
+ TC
= XY

... i.e. the 2L-sized product XY of the L-sized multiplicands X and Y, having done so via three half-L-sized multiplications and a number of inexpensive additions/subtractions.

Satisfy yourself that at no point does the program branch on any bit inside the operands X and Y (i.e. it operates in constant time), and that the required stack memory and the depth of the recursion depend strictly on the FFA bitness set during invocation of FFACalc.


At this point you, dear reader, will have fit FFA multiplication into your head!


In Chapter 12B, we will examine an important special case of Karatsuba that merits a separate routine: squaring. Theoretically this operation requires only half of the CPU cycles demanded by the general case; and as it is made heavy use of in modular exponentiation:

fz_mul.adb:

   -- Modular Exponent: Result := Base^Exponent mod Modulus
   procedure FZ_Mod_Exp(Base     : in  FZ;
                        Exponent : in  FZ;
                        Modulus  : in  FZ;
                        Result   : out FZ) is
 
      -- Working register for the squaring; initially is copy of Base
      B : FZ(Base'Range)     := Base;
 
      -- Copy of Exponent, for cycling through its bits
      E : FZ(Exponent'Range) := Exponent;
 
      -- Register for the Mux operation
      T : FZ(Result'Range);
 
      -- Buffer register for the Result
      R : FZ(Result'Range);
 
   begin
      -- Result := 1
      WBool_To_FZ(1, R);
 
      -- For each bit of R width:
      for i in 1 .. FZ_Bitness(R) loop
 
         -- T := Result * B mod Modulus
         FZ_Mod_Mul(X => R, Y => B, Modulus => Modulus, Product => T);
 
         -- Sel is the current low bit of E;
         --    When Sel=0 -> Result := Result;
         --    When Sel=1 -> Result := T
         FZ_Mux(X => R, Y => T, Result => R, Sel => FZ_OddP(E));
 
         -- Advance to the next bit of E
         FZ_ShiftRight(E, E, 1);
 
         -- B := B*B mod Modulus
         FZ_Mod_Mul(X => B, Y => B, Modulus => Modulus, Product => B);
 
      end loop;
 
      -- Output the Result:
      Result := R;
 
   end FZ_Mod_Exp;
 
end FZ_ModEx;

... we will find that the squaring-case of Karatsuba merits inclusion in FFA.

We will also make use of a simple means of profiling the execution of the FFA routines -- one that is unique in its simplicity, while generally inapplicable to heathen cryptographic libraries on account of their failure to avoid branching on operand bits.


~To be continued!~

“Finite Field Arithmetic” Regrind into Keccak-V Format.

The long-promised Keccak-V regrind of the current FFA codebase appears below:

Title VPatch Seal
“Chapter 1: Genesis.” ffa_ch1_genesis.kv.vpatch ffa_ch1_genesis.kv.vpatch.asciilifeform.sig
“Chapter 2: Logical and Bitwise Operations.” ffa_ch2_logicals.kv.vpatch ffa_ch2_logicals.kv.vpatch.asciilifeform.sig
“Chapter 3: Shifts.” ffa_ch3_shifts.kv.vpatch ffa_ch3_shifts.kv.vpatch.asciilifeform.sig
“Chapter 4: Interlude: FFACalc.” ffa_ch4_ffacalc.kv.vpatch ffa_ch4_ffacalc.kv.vpatch.asciilifeform.sig
“Chapter 5: “Egyptological” Multiplication and Division.” ffa_ch5_egypt.kv.vpatch ffa_ch5_egypt.kv.vpatch.asciilifeform.sig
Chapter 6: “Geological” RSA. ffa_ch6_simplest_rsa.kv.vpatch ffa_ch6_simplest_rsa.kv.vpatch.asciilifeform.sig
Chapter 7: “Turbo Egyptians.” ffa_ch7_turbo_egyptians.kv.vpatch ffa_ch7_turbo_egyptians.kv.vpatch.asciilifeform.sig
Chapter 8: Interlude: Randomism. ffa_ch8_randomism.kv.vpatch ffa_ch8_randomism.kv.vpatch.asciilifeform.sig
Chapter 9: “Exodus from Egypt” with Comba’s Algorithm. ffa_ch9_exodus.kv.vpatch ffa_ch9_exodus.kv.vpatch.asciilifeform.sig
Chapter 10: Introducing Karatsuba’s Multiplication. ffa_ch10_karatsuba.kv.vpatch ffa_ch10_karatsuba.kv.vpatch.asciilifeform.sig
Chapter 11: Tuning and Unified API. ffa_ch11_tuning_and_api.kv.vpatch ffa_ch11_tuning_and_api.kv.vpatch.asciilifeform.sig

These, and all subsequent chapter releases, can be pressed with e.g. Diana Coman’s VTron (and, I expect, various others.)
You can download a convenient tarball with all of the above items, here (signature here.)

To the folks who made this possible : thanks!

“Finite Field Arithmetic” Projected Release Timeline.

Several of my readers recently let me know (privately and in the Forum) that they are ready to pioneer the battlefield use of FFA. However they all have one question, “When the hell will be the beta release? And just how much spade work remains, and where?”

And so I have written this projection, to summarize the articles remaining to write (some of these are already written, and require revision to conform to the corrections introduced in the code earlier; others must still be written, and the corresponding program routines cleaned up, tested, and properly illuminated; hence the variation in the estimated periods required for each component.)

So, without further delay:

No. Chapter Title (Tentative) Target Pub. Date
12 Keccak-V Regrind and Karatsuba In-Depth. Nov. 18, 2018
13 Constant-Time “Shift” and “Rotate”. Nov. 25, 2018
14 Fast Modular Reduction. Dec. 9, 2018
15 Bounded Loops in FFACalc. Dec. 16, 2018
16 Generation of Cryptographic Primes. Dec. 30, 2018
17 Introducing: “P” System. Jan. 6, 2019
18 Practical Key Generation in “P”. Jan. 13, 2019
19 RSA with OAEP; Signature, Encryption, Decryption. Jan. 27, 2019
20 Practical GPG Migration. Feb. 3, 2019
21 Optional: ASM Subroutines for AMD-64. Feb. 10, 2019
22 Misc. Stylistic Massage and Beta Release! Feb. 17, 2019

I reserve the right to run “ahead” of this calendar, if time permits. But if at any point a target date cannot be met, I will post a revised timeline, along with discussion of any pertinent obstacle.

Posted in: FFA, Friends, Progress by Stanislav No Comments

Hypertext Concordance for “Finite Field Arithmetic.”

In addition to phf’s excellent vpatch viewer, there will now be a page, generated via gnathtml, to help the interested reader to explore the moving parts of FFA.

Click here to view Ch.11, with ffa_calc.adb as the root node.

All subsequent chapters will also be offered in this reader-friendly format, in addition to the usual raw vpatch and text discussion. (If anyone wants to see the earlier chapters in this form, please let me know.)

The Serpent Cipher’s Key Schedule Transform is Injective.


This article is a continuation of the previous, and concludes the series.

Let’s try this somewhat different variant of the program, which represents recurring bits of the expansion symbolically (and in a slightly more readable form) :

;; Register bitness.
(defconstant +bitness+ 32)
 
(defun make-reg (reg-name bitness)
  "Make algebraic representation of a register (bits in descending majority)"
  (loop for i from (1- bitness) downto 0 collect
       (make-symbol (format nil "~A~A" reg-name i))))
 
(defun integer-to-reg (n &optional (pad-width +bitness+))
  "Generate algebraic represenation of the given integer n."
  (let* ((bits '())
         (integer-bitness (integer-length n))
         (pad-bitness (- pad-width integer-bitness)))
    (dotimes (index integer-bitness bits)
      (push (if (logbitp index n) 1 0) bits))
    ;; Append padding zeros, if required to make full width:
    (loop repeat pad-bitness do (push 0 bits))
    bits))
 
(defun RL11 (reg)
  "Rotate given register leftward by 11."
  (append
   (subseq reg 11)
   (subseq reg 0 11)))
 
(defmacro reg-xor (&rest regs)
  "Make algebraic representation of the xor of given registers."
  `(map 'list #'(lambda (&rest args) (cons 'xor args)) ,@regs))
 
;; Define the input registers
(defvar *A* (make-reg "a" +bitness+))
(defvar *B* (make-reg "b" +bitness+))
(defvar *C* (make-reg "c" +bitness+))
(defvar *D* (make-reg "d" +bitness+))
(defvar *E* (make-reg "e" +bitness+))
(defvar *F* (make-reg "f" +bitness+))
(defvar *G* (make-reg "g" +bitness+))
(defvar *H* (make-reg "h" +bitness+))
 
;; Serpent's 'goldenratio' turd
(defconstant +serpent-const+ #x9E3779B9)
 
;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;; from serpent.ada: ;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;
;; for I in 0..7 loop
;;   W(-8+I) := Bytes_To_Word(K(4*I .. 4*I+3));
;; end loop;
;; for I in 0..131 loop
;;   W(I) := Rotate_Left(W(I-8) xor W(I-5) xor W(I-3) xor W(I-1) xor
;;           16#9e3779b9# xor Unsigned_32(I), 11);
;; end loop;
 
(defun serp-co-recur (k)
  "Co-recursive helper"
  (if (< k 0)
      (serpent-recurrence k)
      (make-reg (format nil "W~A-" k) +bitness+)))
 
(defun serpent-recurrence (k)
  "Generate k-th term of the Serpent key-expander recurrence equation."
  (case k
    ;; The key terms:
    (-8 *A*) (-7 *B*) (-6 *C*) (-5 *D*) (-4 *E*) (-3 *F*) (-2 *G*) (-1 *H*)
    ;; Any other term:
    (t
     (RL11 (reg-xor
            (integer-to-reg (logxor +serpent-const+ k))
            (serp-co-recur (- k 8))
            (serp-co-recur (- k 5))
            (serp-co-recur (- k 3))
            (serp-co-recur (- k 1)))))))
 
(defun print-reg-w (w reg stream)
  "Print algebraic register as table."
  (let ((l (1- (length reg))))
    (loop for i from 0 upto l do
         (let* ((expr (nth (- l i) reg))
                (const (cadr expr))
                (terms (cddr expr)))
           (loop for clause in terms do
                (format stream " ~7A " clause))
           (format stream "~A --> [W~A-~2d]~%" const w i)))))
 
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;; Print recurrence terms:
(with-open-file (stream "serpent_proofolade.txt"
                        :direction :output
                        :if-exists :overwrite
                        :if-does-not-exist :create)
  (loop for k from 0 upto 131 do
       (progn
         (format stream "~%Serpent W(~A):~%" k)
         (print-reg-w k (serpent-recurrence k) stream))))
 
(quit)

We end up with this output. Observe that, starting with W(8):

Serpent W(8):
 W0-21    W3-21    W5-21    W7-21   1 --> [W8- 0]
 W0-22    W3-22    W5-22    W7-22   0 --> [W8- 1]
 W0-23    W3-23    W5-23    W7-23   0 --> [W8- 2]
 W0-24    W3-24    W5-24    W7-24   0 --> [W8- 3]
 W0-25    W3-25    W5-25    W7-25   1 --> [W8- 4]
 W0-26    W3-26    W5-26    W7-26   1 --> [W8- 5]
 W0-27    W3-27    W5-27    W7-27   1 --> [W8- 6]
 W0-28    W3-28    W5-28    W7-28   1 --> [W8- 7]
 W0-29    W3-29    W5-29    W7-29   0 --> [W8- 8]
 W0-30    W3-30    W5-30    W7-30   0 --> [W8- 9]
 W0-31    W3-31    W5-31    W7-31   1 --> [W8-10]
 W0-0     W3-0     W5-0     W7-0    1 --> [W8-11]
 W0-1     W3-1     W5-1     W7-1    0 --> [W8-12]
 W0-2     W3-2     W5-2     W7-2    0 --> [W8-13]
 W0-3     W3-3     W5-3     W7-3    0 --> [W8-14]
 W0-4     W3-4     W5-4     W7-4    1 --> [W8-15]
 W0-5     W3-5     W5-5     W7-5    1 --> [W8-16]
 W0-6     W3-6     W5-6     W7-6    0 --> [W8-17]
 W0-7     W3-7     W5-7     W7-7    1 --> [W8-18]
 W0-8     W3-8     W5-8     W7-8    1 --> [W8-19]
 W0-9     W3-9     W5-9     W7-9    0 --> [W8-20]
 W0-10    W3-10    W5-10    W7-10   0 --> [W8-21]
 W0-11    W3-11    W5-11    W7-11   1 --> [W8-22]
 W0-12    W3-12    W5-12    W7-12   1 --> [W8-23]
 W0-13    W3-13    W5-13    W7-13   1 --> [W8-24]
 W0-14    W3-14    W5-14    W7-14   1 --> [W8-25]
 W0-15    W3-15    W5-15    W7-15   0 --> [W8-26]
 W0-16    W3-16    W5-16    W7-16   1 --> [W8-27]
 W0-17    W3-17    W5-17    W7-17   1 --> [W8-28]
 W0-18    W3-18    W5-18    W7-18   1 --> [W8-29]
 W0-19    W3-19    W5-19    W7-19   0 --> [W8-30]
 W0-20    W3-20    W5-20    W7-20   1 --> [W8-31]

… no key bits any longer appear directly. Therefore we can constrain the analysis to W (expansion words) 0 through 7.

Now, let’s take the last of these:

Serpent W(7):
 h21      W2-21    W4-21    W6-21   1 --> [W7- 0]
 h22      W2-22    W4-22    W6-22   0 --> [W7- 1]
 h23      W2-23    W4-23    W6-23   0 --> [W7- 2]
 h24      W2-24    W4-24    W6-24   0 --> [W7- 3]
 h25      W2-25    W4-25    W6-25   1 --> [W7- 4]
 h26      W2-26    W4-26    W6-26   1 --> [W7- 5]
 h27      W2-27    W4-27    W6-27   1 --> [W7- 6]
 h28      W2-28    W4-28    W6-28   1 --> [W7- 7]
 h29      W2-29    W4-29    W6-29   0 --> [W7- 8]
 h30      W2-30    W4-30    W6-30   0 --> [W7- 9]
 h31      W2-31    W4-31    W6-31   1 --> [W7-10]
 h0       W2-0     W4-0     W6-0    0 --> [W7-11]
 h1       W2-1     W4-1     W6-1    1 --> [W7-12]
 h2       W2-2     W4-2     W6-2    1 --> [W7-13]
 h3       W2-3     W4-3     W6-3    1 --> [W7-14]
 h4       W2-4     W4-4     W6-4    1 --> [W7-15]
 h5       W2-5     W4-5     W6-5    1 --> [W7-16]
 h6       W2-6     W4-6     W6-6    0 --> [W7-17]
 h7       W2-7     W4-7     W6-7    1 --> [W7-18]
 h8       W2-8     W4-8     W6-8    1 --> [W7-19]
 h9       W2-9     W4-9     W6-9    0 --> [W7-20]
 h10      W2-10    W4-10    W6-10   0 --> [W7-21]
 h11      W2-11    W4-11    W6-11   1 --> [W7-22]
 h12      W2-12    W4-12    W6-12   1 --> [W7-23]
 h13      W2-13    W4-13    W6-13   1 --> [W7-24]
 h14      W2-14    W4-14    W6-14   1 --> [W7-25]
 h15      W2-15    W4-15    W6-15   0 --> [W7-26]
 h16      W2-16    W4-16    W6-16   1 --> [W7-27]
 h17      W2-17    W4-17    W6-17   1 --> [W7-28]
 h18      W2-18    W4-18    W6-18   1 --> [W7-29]
 h19      W2-19    W4-19    W6-19   0 --> [W7-30]
 h20      W2-20    W4-20    W6-20   1 --> [W7-31]

Observe that, e.g., h21 xor W2-21 xor W4-21 xor W6-21 xor 1, which forms the output bit [W7- 0] , does not permit any alternate value for h21 — given as W2-21, W4-21, and W6-21 must remain fixed. And that the same thing is true for all other bits in the key register H.

Now we continue walking backwards through the expansion:

Serpent W(6):
 g21      W1-21    W3-21    W5-21   1 --> [W6- 0]
 g22      W1-22    W3-22    W5-22   0 --> [W6- 1]
 g23      W1-23    W3-23    W5-23   0 --> [W6- 2]
 g24      W1-24    W3-24    W5-24   0 --> [W6- 3]
 g25      W1-25    W3-25    W5-25   1 --> [W6- 4]
 g26      W1-26    W3-26    W5-26   1 --> [W6- 5]
 g27      W1-27    W3-27    W5-27   1 --> [W6- 6]
 g28      W1-28    W3-28    W5-28   1 --> [W6- 7]
 g29      W1-29    W3-29    W5-29   0 --> [W6- 8]
 g30      W1-30    W3-30    W5-30   0 --> [W6- 9]
 g31      W1-31    W3-31    W5-31   1 --> [W6-10]
 g0       W1-0     W3-0     W5-0    1 --> [W6-11]
 g1       W1-1     W3-1     W5-1    1 --> [W6-12]
 g2       W1-2     W3-2     W5-2    1 --> [W6-13]
 g3       W1-3     W3-3     W5-3    1 --> [W6-14]
 g4       W1-4     W3-4     W5-4    1 --> [W6-15]
 g5       W1-5     W3-5     W5-5    1 --> [W6-16]
 g6       W1-6     W3-6     W5-6    0 --> [W6-17]
 g7       W1-7     W3-7     W5-7    1 --> [W6-18]
 g8       W1-8     W3-8     W5-8    1 --> [W6-19]
 g9       W1-9     W3-9     W5-9    0 --> [W6-20]
 g10      W1-10    W3-10    W5-10   0 --> [W6-21]
 g11      W1-11    W3-11    W5-11   1 --> [W6-22]
 g12      W1-12    W3-12    W5-12   1 --> [W6-23]
 g13      W1-13    W3-13    W5-13   1 --> [W6-24]
 g14      W1-14    W3-14    W5-14   1 --> [W6-25]
 g15      W1-15    W3-15    W5-15   0 --> [W6-26]
 g16      W1-16    W3-16    W5-16   1 --> [W6-27]
 g17      W1-17    W3-17    W5-17   1 --> [W6-28]
 g18      W1-18    W3-18    W5-18   1 --> [W6-29]
 g19      W1-19    W3-19    W5-19   0 --> [W6-30]
 g20      W1-20    W3-20    W5-20   1 --> [W6-31]
 
Serpent W(5):
 f21      W0-21    W2-21    W4-21   1 --> [W5- 0]
 f22      W0-22    W2-22    W4-22   0 --> [W5- 1]
 f23      W0-23    W2-23    W4-23   0 --> [W5- 2]
 f24      W0-24    W2-24    W4-24   0 --> [W5- 3]
 f25      W0-25    W2-25    W4-25   1 --> [W5- 4]
 f26      W0-26    W2-26    W4-26   1 --> [W5- 5]
 f27      W0-27    W2-27    W4-27   1 --> [W5- 6]
 f28      W0-28    W2-28    W4-28   1 --> [W5- 7]
 f29      W0-29    W2-29    W4-29   0 --> [W5- 8]
 f30      W0-30    W2-30    W4-30   0 --> [W5- 9]
 f31      W0-31    W2-31    W4-31   1 --> [W5-10]
 f0       W0-0     W2-0     W4-0    0 --> [W5-11]
 f1       W0-1     W2-1     W4-1    0 --> [W5-12]
 f2       W0-2     W2-2     W4-2    1 --> [W5-13]
 f3       W0-3     W2-3     W4-3    1 --> [W5-14]
 f4       W0-4     W2-4     W4-4    1 --> [W5-15]
 f5       W0-5     W2-5     W4-5    1 --> [W5-16]
 f6       W0-6     W2-6     W4-6    0 --> [W5-17]
 f7       W0-7     W2-7     W4-7    1 --> [W5-18]
 f8       W0-8     W2-8     W4-8    1 --> [W5-19]
 f9       W0-9     W2-9     W4-9    0 --> [W5-20]
 f10      W0-10    W2-10    W4-10   0 --> [W5-21]
 f11      W0-11    W2-11    W4-11   1 --> [W5-22]
 f12      W0-12    W2-12    W4-12   1 --> [W5-23]
 f13      W0-13    W2-13    W4-13   1 --> [W5-24]
 f14      W0-14    W2-14    W4-14   1 --> [W5-25]
 f15      W0-15    W2-15    W4-15   0 --> [W5-26]
 f16      W0-16    W2-16    W4-16   1 --> [W5-27]
 f17      W0-17    W2-17    W4-17   1 --> [W5-28]
 f18      W0-18    W2-18    W4-18   1 --> [W5-29]
 f19      W0-19    W2-19    W4-19   0 --> [W5-30]
 f20      W0-20    W2-20    W4-20   1 --> [W5-31]

Key registers G and F are nailed down in precisely the same way as H was earlier shown to be. Let’s continue,

Serpent W(4):
 e21      h21      W1-21    W3-21   1 --> [W4- 0]
 e22      h22      W1-22    W3-22   0 --> [W4- 1]
 e23      h23      W1-23    W3-23   0 --> [W4- 2]
 e24      h24      W1-24    W3-24   0 --> [W4- 3]
 e25      h25      W1-25    W3-25   1 --> [W4- 4]
 e26      h26      W1-26    W3-26   1 --> [W4- 5]
 e27      h27      W1-27    W3-27   1 --> [W4- 6]
 e28      h28      W1-28    W3-28   1 --> [W4- 7]
 e29      h29      W1-29    W3-29   0 --> [W4- 8]
 e30      h30      W1-30    W3-30   0 --> [W4- 9]
 e31      h31      W1-31    W3-31   1 --> [W4-10]
 e0       h0       W1-0     W3-0    1 --> [W4-11]
 e1       h1       W1-1     W3-1    0 --> [W4-12]
 e2       h2       W1-2     W3-2    1 --> [W4-13]
 e3       h3       W1-3     W3-3    1 --> [W4-14]
 e4       h4       W1-4     W3-4    1 --> [W4-15]
 e5       h5       W1-5     W3-5    1 --> [W4-16]
 e6       h6       W1-6     W3-6    0 --> [W4-17]
 e7       h7       W1-7     W3-7    1 --> [W4-18]
 e8       h8       W1-8     W3-8    1 --> [W4-19]
 e9       h9       W1-9     W3-9    0 --> [W4-20]
 e10      h10      W1-10    W3-10   0 --> [W4-21]
 e11      h11      W1-11    W3-11   1 --> [W4-22]
 e12      h12      W1-12    W3-12   1 --> [W4-23]
 e13      h13      W1-13    W3-13   1 --> [W4-24]
 e14      h14      W1-14    W3-14   1 --> [W4-25]
 e15      h15      W1-15    W3-15   0 --> [W4-26]
 e16      h16      W1-16    W3-16   1 --> [W4-27]
 e17      h17      W1-17    W3-17   1 --> [W4-28]
 e18      h18      W1-18    W3-18   1 --> [W4-29]
 e19      h19      W1-19    W3-19   0 --> [W4-30]
 e20      h20      W1-20    W3-20   1 --> [W4-31]
 
Serpent W(3):
 d21      g21      W0-21    W2-21   1 --> [W3- 0]
 d22      g22      W0-22    W2-22   0 --> [W3- 1]
 d23      g23      W0-23    W2-23   0 --> [W3- 2]
 d24      g24      W0-24    W2-24   0 --> [W3- 3]
 d25      g25      W0-25    W2-25   1 --> [W3- 4]
 d26      g26      W0-26    W2-26   1 --> [W3- 5]
 d27      g27      W0-27    W2-27   1 --> [W3- 6]
 d28      g28      W0-28    W2-28   1 --> [W3- 7]
 d29      g29      W0-29    W2-29   0 --> [W3- 8]
 d30      g30      W0-30    W2-30   0 --> [W3- 9]
 d31      g31      W0-31    W2-31   1 --> [W3-10]
 d0       g0       W0-0     W2-0    0 --> [W3-11]
 d1       g1       W0-1     W2-1    1 --> [W3-12]
 d2       g2       W0-2     W2-2    0 --> [W3-13]
 d3       g3       W0-3     W2-3    1 --> [W3-14]
 d4       g4       W0-4     W2-4    1 --> [W3-15]
 d5       g5       W0-5     W2-5    1 --> [W3-16]
 d6       g6       W0-6     W2-6    0 --> [W3-17]
 d7       g7       W0-7     W2-7    1 --> [W3-18]
 d8       g8       W0-8     W2-8    1 --> [W3-19]
 d9       g9       W0-9     W2-9    0 --> [W3-20]
 d10      g10      W0-10    W2-10   0 --> [W3-21]
 d11      g11      W0-11    W2-11   1 --> [W3-22]
 d12      g12      W0-12    W2-12   1 --> [W3-23]
 d13      g13      W0-13    W2-13   1 --> [W3-24]
 d14      g14      W0-14    W2-14   1 --> [W3-25]
 d15      g15      W0-15    W2-15   0 --> [W3-26]
 d16      g16      W0-16    W2-16   1 --> [W3-27]
 d17      g17      W0-17    W2-17   1 --> [W3-28]
 d18      g18      W0-18    W2-18   1 --> [W3-29]
 d19      g19      W0-19    W2-19   0 --> [W3-30]
 d20      g20      W0-20    W2-20   1 --> [W3-31]

Having already found H, G and F to be immovable, we treat their values as constants and find that E and D are also fixed (no bit-flippage is possible in them without affecting the value of a key expansion bit.) Continuing:

Serpent W(2):
 c21      f21      h21      W1-21   1 --> [W2- 0]
 c22      f22      h22      W1-22   0 --> [W2- 1]
 c23      f23      h23      W1-23   0 --> [W2- 2]
 c24      f24      h24      W1-24   0 --> [W2- 3]
 c25      f25      h25      W1-25   1 --> [W2- 4]
 c26      f26      h26      W1-26   1 --> [W2- 5]
 c27      f27      h27      W1-27   1 --> [W2- 6]
 c28      f28      h28      W1-28   1 --> [W2- 7]
 c29      f29      h29      W1-29   0 --> [W2- 8]
 c30      f30      h30      W1-30   0 --> [W2- 9]
 c31      f31      h31      W1-31   1 --> [W2-10]
 c0       f0       h0       W1-0    1 --> [W2-11]
 c1       f1       h1       W1-1    1 --> [W2-12]
 c2       f2       h2       W1-2    0 --> [W2-13]
 c3       f3       h3       W1-3    1 --> [W2-14]
 c4       f4       h4       W1-4    1 --> [W2-15]
 c5       f5       h5       W1-5    1 --> [W2-16]
 c6       f6       h6       W1-6    0 --> [W2-17]
 c7       f7       h7       W1-7    1 --> [W2-18]
 c8       f8       h8       W1-8    1 --> [W2-19]
 c9       f9       h9       W1-9    0 --> [W2-20]
 c10      f10      h10      W1-10   0 --> [W2-21]
 c11      f11      h11      W1-11   1 --> [W2-22]
 c12      f12      h12      W1-12   1 --> [W2-23]
 c13      f13      h13      W1-13   1 --> [W2-24]
 c14      f14      h14      W1-14   1 --> [W2-25]
 c15      f15      h15      W1-15   0 --> [W2-26]
 c16      f16      h16      W1-16   1 --> [W2-27]
 c17      f17      h17      W1-17   1 --> [W2-28]
 c18      f18      h18      W1-18   1 --> [W2-29]
 c19      f19      h19      W1-19   0 --> [W2-30]
 c20      f20      h20      W1-20   1 --> [W2-31]

Key register C is nailed down;

Serpent W(1):
 b21      e21      g21      W0-21   1 --> [W1- 0]
 b22      e22      g22      W0-22   0 --> [W1- 1]
 b23      e23      g23      W0-23   0 --> [W1- 2]
 b24      e24      g24      W0-24   0 --> [W1- 3]
 b25      e25      g25      W0-25   1 --> [W1- 4]
 b26      e26      g26      W0-26   1 --> [W1- 5]
 b27      e27      g27      W0-27   1 --> [W1- 6]
 b28      e28      g28      W0-28   1 --> [W1- 7]
 b29      e29      g29      W0-29   0 --> [W1- 8]
 b30      e30      g30      W0-30   0 --> [W1- 9]
 b31      e31      g31      W0-31   1 --> [W1-10]
 b0       e0       g0       W0-0    0 --> [W1-11]
 b1       e1       g1       W0-1    0 --> [W1-12]
 b2       e2       g2       W0-2    0 --> [W1-13]
 b3       e3       g3       W0-3    1 --> [W1-14]
 b4       e4       g4       W0-4    1 --> [W1-15]
 b5       e5       g5       W0-5    1 --> [W1-16]
 b6       e6       g6       W0-6    0 --> [W1-17]
 b7       e7       g7       W0-7    1 --> [W1-18]
 b8       e8       g8       W0-8    1 --> [W1-19]
 b9       e9       g9       W0-9    0 --> [W1-20]
 b10      e10      g10      W0-10   0 --> [W1-21]
 b11      e11      g11      W0-11   1 --> [W1-22]
 b12      e12      g12      W0-12   1 --> [W1-23]
 b13      e13      g13      W0-13   1 --> [W1-24]
 b14      e14      g14      W0-14   1 --> [W1-25]
 b15      e15      g15      W0-15   0 --> [W1-26]
 b16      e16      g16      W0-16   1 --> [W1-27]
 b17      e17      g17      W0-17   1 --> [W1-28]
 b18      e18      g18      W0-18   1 --> [W1-29]
 b19      e19      g19      W0-19   0 --> [W1-30]
 b20      e20      g20      W0-20   1 --> [W1-31]

… and B;

Serpent W(0):
 a21      d21      f21      h21     1 --> [W0- 0]
 a22      d22      f22      h22     0 --> [W0- 1]
 a23      d23      f23      h23     0 --> [W0- 2]
 a24      d24      f24      h24     0 --> [W0- 3]
 a25      d25      f25      h25     1 --> [W0- 4]
 a26      d26      f26      h26     1 --> [W0- 5]
 a27      d27      f27      h27     1 --> [W0- 6]
 a28      d28      f28      h28     1 --> [W0- 7]
 a29      d29      f29      h29     0 --> [W0- 8]
 a30      d30      f30      h30     0 --> [W0- 9]
 a31      d31      f31      h31     1 --> [W0-10]
 a0       d0       f0       h0      1 --> [W0-11]
 a1       d1       f1       h1      0 --> [W0-12]
 a2       d2       f2       h2      0 --> [W0-13]
 a3       d3       f3       h3      1 --> [W0-14]
 a4       d4       f4       h4      1 --> [W0-15]
 a5       d5       f5       h5      1 --> [W0-16]
 a6       d6       f6       h6      0 --> [W0-17]
 a7       d7       f7       h7      1 --> [W0-18]
 a8       d8       f8       h8      1 --> [W0-19]
 a9       d9       f9       h9      0 --> [W0-20]
 a10      d10      f10      h10     0 --> [W0-21]
 a11      d11      f11      h11     1 --> [W0-22]
 a12      d12      f12      h12     1 --> [W0-23]
 a13      d13      f13      h13     1 --> [W0-24]
 a14      d14      f14      h14     1 --> [W0-25]
 a15      d15      f15      h15     0 --> [W0-26]
 a16      d16      f16      h16     1 --> [W0-27]
 a17      d17      f17      h17     1 --> [W0-28]
 a18      d18      f18      h18     1 --> [W0-29]
 a19      d19      f19      h19     0 --> [W0-30]
 a20      d20      f20      h20     1 --> [W0-31]

… and A. Which accounts for the entire key.

There is not, in fact, any possibility of changing any portion of the key without producing a change in an output expansion bit, regardless of what you do. Ergo, we have the previously-sought proof:

The key expander of the Serpent cipher is injective, there are precisely 2256 possible expansions — one for each possible key.

There still could be interesting problems with the expander (e.g., it is — by all indications — reversible) but, at the very least, it is entropy-conserving.

Why the original authors of Serpent did not see it fit to present this proof to the public, I do not know; but now it can be seen here.

The remaining components of the Serpent cipher, we will leave for another time.


~The End~ (For now…)

The Serpent Cipher’s Key Schedule Equation System, in Graphical Form.


This article is a continuation of the dig into the key schedule of the Serpent cipher.

For clarity, we will omit the routines already given in the previous article.

Let’s visualize the Serpent key schedule as a graphic:

;; 256bit(key)+1(const) x 4224(132*32) matrix, last column for constant subterms
(defvar *matrix* (make-array '(257 4224) :element-type '(mod 1)))
 
;; All of the 256 key-bits, from a0 .. h31
(defvar *keybits* (append (reverse *a*) (reverse *b*)
                          (reverse *c*) (reverse *d*)
                          (reverse *e*) (reverse *f*)
                          (reverse *g*) (reverse *h*)))
 
(defun key-bit-pos (keybit)
  "Find the position of a given key bit token in the 256-bit key."
  (position keybit *keybits*))
 
;; Form the matrix.
(loop for k from 0 upto 131 do
     (let ((terms (serpent-recurrence k))) ;; current w-term
       (loop for w-bit from 0 upto (1- +bitness+) do
            ;; current bit of w-term
            (let* ((w-row (+ (* k +bitness+) w-bit))
                   (term (nth (1- (- +bitness+ w-bit)) terms))
                   ;; the constant term
                   (const (if (equal (second term) 1)
                              1
                              0))
                   ;; the free variables
                   (clause (if (zerop const)
                               (cdr term)
                               (cddr term))))
              ;; save the free variables into the matrix
              (loop for var in clause do
                   (setf (aref *matrix*
                               (key-bit-pos var)
                               w-row)
                         1))
              ;; save the constant term into last column of matrix
              (setf (aref *matrix*
                          256
                          w-row)
                    const)))))
 
;; let's have it as bitmap:
(with-open-file (stream "serpent.pbm"
                        :direction :output
                        :if-exists :overwrite
                        :if-does-not-exist :create)
  (format stream "P1~%#serpent~%~A ~A~%" 257 4224)
  (loop for wb from 0 to 4223 do
       (loop for kb from 0 to 256 do
            (format stream "~A " (aref *matrix* kb wb)))
       (format stream "~%")))
 
(quit)

From this, we get this rather peculiar item, with a number of obvious (and an unknown number of non-obvious!) regularities:


Serpent Key Schedule


The rows in this graphic correspond to bits of the Serpent key schedule (prior to the S-Boxing — which is not of interest here, as it is entropy-conserving.) The columns correspond to bits of the input K (the 256-bit key) which appear in the XOR equation which produces that particular bit of the schedule. The final column corresponds to the constant term in the XOR equation.


It seems to me that colliding inputs of K — i.e. K1, K2, Kn which produce identical schedules — are nearly certain to exist, and that Serpent is thereby not in fact a cipher with 256-bit keyspace, contrary to the authors’ claim.
(Spoiler: nope)


The next logical step will be to reduce the system to a XOR-SAT and get at the actual “bitness” of Serpent’s keyspace.
(Spoiler: wasn’t needed)

~To be continued!~

Serpent Cipher’s Key Schedule in Algebraic Form: with Reduction.


This article is a continuation of the recent mega-puzzler concerning the experiment.

This variant will reduce the equations. We will omit printing the input matrix, for brevity. And so:

;; Register bitness.
(defconstant +bitness+ 32)
 
(defun flatten (l)
  "Flatten a tree."
  (cond ((null l) nil)
        ((atom l) (list l))
        (t (mapcan #'flatten l))))
 
(defun make-reg (reg-name bitness)
  "Make algebraic representation of a register (bits in descending majority)"
  (loop for i from (1- bitness) downto 0 collect
       (make-symbol (format nil "~A~A" reg-name i))))
 
(defun integer-to-reg (n &optional (pad-width +bitness+))
  "Generate algebraic represenation of the given integer n."
  (let* ((bits '())
         (integer-bitness (integer-length n))
         (pad-bitness (- pad-width integer-bitness)))
    (dotimes (index integer-bitness bits)
      (push (if (logbitp index n) 1 0) bits))
    ;; Append padding zeros, if required to make full width:
    (loop repeat pad-bitness do (push 0 bits))
    bits))
 
(defun RL11 (reg)
  "Rotate given register leftward by 11."
  (append
   (subseq reg 11)
   (subseq reg 0 11)))
 
(defmacro reg-xor (&rest regs)
  "Make algebraic representation of the xor of given registers."
  `(map 'list #'(lambda (&rest args) (cons 'xor args)) ,@regs))
 
(defun print-reg (reg stream)
  "Print algebraic register as table, in descending bit majority"
  (let ((l (1- (length reg))))
    (loop for i from 0 upto l do
         (format stream "[bit:~2d] : ~A~%" i
                 (nth (- l i) reg)))))
 
;; Define the input registers
(defvar *A* (make-reg "a" +bitness+))
(defvar *B* (make-reg "b" +bitness+))
(defvar *C* (make-reg "c" +bitness+))
(defvar *D* (make-reg "d" +bitness+))
(defvar *E* (make-reg "e" +bitness+))
(defvar *F* (make-reg "f" +bitness+))
(defvar *G* (make-reg "g" +bitness+))
(defvar *H* (make-reg "h" +bitness+))
 
;; Serpent's 'goldenratio' turd
(defconstant +serpent-const+ #x9E3779B9)
 
;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;; from serpent.ada: ;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;
;; for I in 0..7 loop
;;   W(-8+I) := Bytes_To_Word(K(4*I .. 4*I+3));
;; end loop;
;; for I in 0..131 loop
;;   W(I) := Rotate_Left(W(I-8) xor W(I-5) xor W(I-3) xor W(I-1) xor
;;           16#9e3779b9# xor Unsigned_32(I), 11);
;; end loop;
 
(defun simplify-term (term)
  "Simplify algebraic term containing XOR, constants, and registers."
  (let ((constants '())
        (variables '())
        (flattened-term (remove 'XOR (flatten term))))
    (loop for subterm in flattened-term do
         (if (numberp subterm)
             (push subterm constants)
             (push subterm variables)))
    (cons 'XOR
          (let ((constant-term (apply #'logxor constants)))
            (if (zerop constant-term)
                variables
                (cons constant-term variables))))))
 
(defun cancel-xor-subterms (expr)
  "Cancel subterms of flat equation which appear even number of times."
  (let ((subterms (cdr expr))) ;; lose the 'XOR
    (cons 'XOR
          (remove-duplicates
           (loop for subterm in subterms
              when (oddp (count subterm subterms))
              collect subterm)))))
 
(defun simplify-reg (reg)
  "Simplify every bit's equation, in a register."
  (loop for bit in reg collect
       (cancel-xor-subterms
        (simplify-term bit))))
 
;; Memoization for recurrence terms
(defvar *recurr-memo* (make-hash-table))
 
(defun get-memo (k)
  "Get memoized term k, if it exists"
  (gethash k *recurr-memo*))
 
(defun put-memo (k term)
  "Memoize k-th term."
  (setf (gethash k *recurr-memo*) term))
 
(defun serpent-recurrence (k)
  "Generate k-th term of the Serpent key-expander recurrence equation."
  (let ((memo (get-memo k)))
    (if memo
        memo
        (put-memo
         k
         (case k
           ;; The key terms:
           (-8 *A*) (-7 *B*) (-6 *C*) (-5 *D*) (-4 *E*) (-3 *F*) (-2 *G*) (-1 *H*)
           ;; Any other term:
           (t
            (simplify-reg
             (RL11 (reg-xor
                    (integer-to-reg (logxor +serpent-const+ k))
                    (serpent-recurrence (- k 8))
                    (serpent-recurrence (- k 5))
                    (serpent-recurrence (- k 3))
                    (serpent-recurrence (- k 1)))))))))))
 
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;; Print recurrence terms from 0 to 131:
 
(with-open-file (stream "serpent_with_reduction.txt"
                        :direction :output
                        :if-exists :overwrite
                        :if-does-not-exist :create)
  (loop for k from 0 upto 131 do
       (progn
         (format stream "~%Serpent W(~A):~%" k)
         (print-reg (serpent-recurrence k) stream))))
 
(quit)

Producing, in half a minute or so:
this.


Observe that expressions of the form (XOR 1 …) are equivalent to a NOT (XOR …).

In the next and final article in this series… the money shot!

~To be continued!~

Terms -8…8 of the Serpent Cipher’s Key Schedule in Algebraic Form.


This article is a byproduct of the recent mega-puzzler concerning the Serpent cipher’s key expansion procedure.

Behold:

;; Register bitness.
(defconstant +bitness+ 32)
 
(defun make-reg (reg-name bitness)
  "Make algebraic representation of a register (bits in descending majority)"
  (loop for i from (1- bitness) downto 0 collect
       (make-symbol (format nil "~A~A" reg-name i))))
 
(defun integer-to-reg (n &optional (pad-width +bitness+))
  "Generate algebraic represenation of the given integer n."
  (let* ((bits '())
         (integer-bitness (integer-length n))
         (pad-bitness (- pad-width integer-bitness)))
    (dotimes (index integer-bitness bits)
      (push (if (logbitp index n) 1 0) bits))
    ;; Append padding zeros, if required to make full width:
    (loop repeat pad-bitness do (push 0 bits))
    bits))
 
(defun RL11 (reg)
  "Rotate given register leftward by 11."
  (append
   (subseq reg 11)
   (subseq reg 0 11)))
 
(defmacro reg-xor (&rest regs)
  "Make algebraic representation of the xor of given registers."
  `(map 'list #'(lambda (&rest args) (cons 'xor args)) ,@regs))
 
(defun print-reg (reg)
  "Print algebraic register as table, in descending bit majority"
  (let ((l (1- (length reg))))
    (loop for i from 0 upto l do
         (format t "[bit:~2d] : ~A~%" i (nth (- l i) reg)))))
 
;; Define the input registers
(defvar *A* (make-reg "a" +bitness+))
(defvar *B* (make-reg "b" +bitness+))
(defvar *C* (make-reg "c" +bitness+))
(defvar *D* (make-reg "d" +bitness+))
(defvar *E* (make-reg "e" +bitness+))
(defvar *F* (make-reg "f" +bitness+))
(defvar *G* (make-reg "g" +bitness+))
(defvar *H* (make-reg "h" +bitness+))
 
;; Serpent's 'goldenratio' turd
(defconstant +serpent-const+ #x9E3779B9)
 
;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;; from serpent.ada: ;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;
;; for I in 0..7 loop
;;   W(-8+I) := Bytes_To_Word(K(4*I .. 4*I+3));
;; end loop;
;; for I in 0..131 loop
;;   W(I) := Rotate_Left(W(I-8) xor W(I-5) xor W(I-3) xor W(I-1) xor
;;           16#9e3779b9# xor Unsigned_32(I), 11);
;; end loop;
 
(defun serpent-recurrence (k)
  "Generate k-th term of the Serpent key-expander recurrence equation."
  (case k
    ;; The key terms:
    (-8 *A*) (-7 *B*) (-6 *C*) (-5 *D*) (-4 *E*) (-3 *F*) (-2 *G*) (-1 *H*)
    ;; Any other term:
    (t
     (RL11 (reg-xor
            (integer-to-reg (logxor +serpent-const+ k))
            (serpent-recurrence (- k 8))
            (serpent-recurrence (- k 5))
            (serpent-recurrence (- k 3))
            (serpent-recurrence (- k 1)))))))
 
(defun print-serpent-recurrent-term (k)
  "Print k-th term of the serpent key-expander recurrence equation."
  (format t "~%Serpent W(~A):~%" k)
  (print-reg (serpent-recurrence k)))
 
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;; Print recurrence terms from -8 to 8:
(loop for k from -8 upto 8 do
     (print-serpent-recurrent-term k))
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

Producing the following output:

Serpent W(-8):
[bit: 0] : a0
[bit: 1] : a1
[bit: 2] : a2
[bit: 3] : a3
[bit: 4] : a4
[bit: 5] : a5
[bit: 6] : a6
[bit: 7] : a7
[bit: 8] : a8
[bit: 9] : a9
[bit:10] : a10
[bit:11] : a11
[bit:12] : a12
[bit:13] : a13
[bit:14] : a14
[bit:15] : a15
[bit:16] : a16
[bit:17] : a17
[bit:18] : a18
[bit:19] : a19
[bit:20] : a20
[bit:21] : a21
[bit:22] : a22
[bit:23] : a23
[bit:24] : a24
[bit:25] : a25
[bit:26] : a26
[bit:27] : a27
[bit:28] : a28
[bit:29] : a29
[bit:30] : a30
[bit:31] : a31
 
Serpent W(-7):
[bit: 0] : b0
[bit: 1] : b1
[bit: 2] : b2
[bit: 3] : b3
[bit: 4] : b4
[bit: 5] : b5
[bit: 6] : b6
[bit: 7] : b7
[bit: 8] : b8
[bit: 9] : b9
[bit:10] : b10
[bit:11] : b11
[bit:12] : b12
[bit:13] : b13
[bit:14] : b14
[bit:15] : b15
[bit:16] : b16
[bit:17] : b17
[bit:18] : b18
[bit:19] : b19
[bit:20] : b20
[bit:21] : b21
[bit:22] : b22
[bit:23] : b23
[bit:24] : b24
[bit:25] : b25
[bit:26] : b26
[bit:27] : b27
[bit:28] : b28
[bit:29] : b29
[bit:30] : b30
[bit:31] : b31
 
Serpent W(-6):
[bit: 0] : c0
[bit: 1] : c1
[bit: 2] : c2
[bit: 3] : c3
[bit: 4] : c4
[bit: 5] : c5
[bit: 6] : c6
[bit: 7] : c7
[bit: 8] : c8
[bit: 9] : c9
[bit:10] : c10
[bit:11] : c11
[bit:12] : c12
[bit:13] : c13
[bit:14] : c14
[bit:15] : c15
[bit:16] : c16
[bit:17] : c17
[bit:18] : c18
[bit:19] : c19
[bit:20] : c20
[bit:21] : c21
[bit:22] : c22
[bit:23] : c23
[bit:24] : c24
[bit:25] : c25
[bit:26] : c26
[bit:27] : c27
[bit:28] : c28
[bit:29] : c29
[bit:30] : c30
[bit:31] : c31
 
Serpent W(-5):
[bit: 0] : d0
[bit: 1] : d1
[bit: 2] : d2
[bit: 3] : d3
[bit: 4] : d4
[bit: 5] : d5
[bit: 6] : d6
[bit: 7] : d7
[bit: 8] : d8
[bit: 9] : d9
[bit:10] : d10
[bit:11] : d11
[bit:12] : d12
[bit:13] : d13
[bit:14] : d14
[bit:15] : d15
[bit:16] : d16
[bit:17] : d17
[bit:18] : d18
[bit:19] : d19
[bit:20] : d20
[bit:21] : d21
[bit:22] : d22
[bit:23] : d23
[bit:24] : d24
[bit:25] : d25
[bit:26] : d26
[bit:27] : d27
[bit:28] : d28
[bit:29] : d29
[bit:30] : d30
[bit:31] : d31
 
Serpent W(-4):
[bit: 0] : e0
[bit: 1] : e1
[bit: 2] : e2
[bit: 3] : e3
[bit: 4] : e4
[bit: 5] : e5
[bit: 6] : e6
[bit: 7] : e7
[bit: 8] : e8
[bit: 9] : e9
[bit:10] : e10
[bit:11] : e11
[bit:12] : e12
[bit:13] : e13
[bit:14] : e14
[bit:15] : e15
[bit:16] : e16
[bit:17] : e17
[bit:18] : e18
[bit:19] : e19
[bit:20] : e20
[bit:21] : e21
[bit:22] : e22
[bit:23] : e23
[bit:24] : e24
[bit:25] : e25
[bit:26] : e26
[bit:27] : e27
[bit:28] : e28
[bit:29] : e29
[bit:30] : e30
[bit:31] : e31
 
Serpent W(-3):
[bit: 0] : f0
[bit: 1] : f1
[bit: 2] : f2
[bit: 3] : f3
[bit: 4] : f4
[bit: 5] : f5
[bit: 6] : f6
[bit: 7] : f7
[bit: 8] : f8
[bit: 9] : f9
[bit:10] : f10
[bit:11] : f11
[bit:12] : f12
[bit:13] : f13
[bit:14] : f14
[bit:15] : f15
[bit:16] : f16
[bit:17] : f17
[bit:18] : f18
[bit:19] : f19
[bit:20] : f20
[bit:21] : f21
[bit:22] : f22
[bit:23] : f23
[bit:24] : f24
[bit:25] : f25
[bit:26] : f26
[bit:27] : f27
[bit:28] : f28
[bit:29] : f29
[bit:30] : f30
[bit:31] : f31
 
Serpent W(-2):
[bit: 0] : g0
[bit: 1] : g1
[bit: 2] : g2
[bit: 3] : g3
[bit: 4] : g4
[bit: 5] : g5
[bit: 6] : g6
[bit: 7] : g7
[bit: 8] : g8
[bit: 9] : g9
[bit:10] : g10
[bit:11] : g11
[bit:12] : g12
[bit:13] : g13
[bit:14] : g14
[bit:15] : g15
[bit:16] : g16
[bit:17] : g17
[bit:18] : g18
[bit:19] : g19
[bit:20] : g20
[bit:21] : g21
[bit:22] : g22
[bit:23] : g23
[bit:24] : g24
[bit:25] : g25
[bit:26] : g26
[bit:27] : g27
[bit:28] : g28
[bit:29] : g29
[bit:30] : g30
[bit:31] : g31
 
Serpent W(-1):
[bit: 0] : h0
[bit: 1] : h1
[bit: 2] : h2
[bit: 3] : h3
[bit: 4] : h4
[bit: 5] : h5
[bit: 6] : h6
[bit: 7] : h7
[bit: 8] : h8
[bit: 9] : h9
[bit:10] : h10
[bit:11] : h11
[bit:12] : h12
[bit:13] : h13
[bit:14] : h14
[bit:15] : h15
[bit:16] : h16
[bit:17] : h17
[bit:18] : h18
[bit:19] : h19
[bit:20] : h20
[bit:21] : h21
[bit:22] : h22
[bit:23] : h23
[bit:24] : h24
[bit:25] : h25
[bit:26] : h26
[bit:27] : h27
[bit:28] : h28
[bit:29] : h29
[bit:30] : h30
[bit:31] : h31
 
Serpent W(0):
[bit: 0] : (XOR 1 a21 d21 f21 h21)
[bit: 1] : (XOR 0 a22 d22 f22 h22)
[bit: 2] : (XOR 0 a23 d23 f23 h23)
[bit: 3] : (XOR 0 a24 d24 f24 h24)
[bit: 4] : (XOR 1 a25 d25 f25 h25)
[bit: 5] : (XOR 1 a26 d26 f26 h26)
[bit: 6] : (XOR 1 a27 d27 f27 h27)
[bit: 7] : (XOR 1 a28 d28 f28 h28)
[bit: 8] : (XOR 0 a29 d29 f29 h29)
[bit: 9] : (XOR 0 a30 d30 f30 h30)
[bit:10] : (XOR 1 a31 d31 f31 h31)
[bit:11] : (XOR 1 a0 d0 f0 h0)
[bit:12] : (XOR 0 a1 d1 f1 h1)
[bit:13] : (XOR 0 a2 d2 f2 h2)
[bit:14] : (XOR 1 a3 d3 f3 h3)
[bit:15] : (XOR 1 a4 d4 f4 h4)
[bit:16] : (XOR 1 a5 d5 f5 h5)
[bit:17] : (XOR 0 a6 d6 f6 h6)
[bit:18] : (XOR 1 a7 d7 f7 h7)
[bit:19] : (XOR 1 a8 d8 f8 h8)
[bit:20] : (XOR 0 a9 d9 f9 h9)
[bit:21] : (XOR 0 a10 d10 f10 h10)
[bit:22] : (XOR 1 a11 d11 f11 h11)
[bit:23] : (XOR 1 a12 d12 f12 h12)
[bit:24] : (XOR 1 a13 d13 f13 h13)
[bit:25] : (XOR 1 a14 d14 f14 h14)
[bit:26] : (XOR 0 a15 d15 f15 h15)
[bit:27] : (XOR 1 a16 d16 f16 h16)
[bit:28] : (XOR 1 a17 d17 f17 h17)
[bit:29] : (XOR 1 a18 d18 f18 h18)
[bit:30] : (XOR 0 a19 d19 f19 h19)
[bit:31] : (XOR 1 a20 d20 f20 h20)
 
Serpent W(1):
[bit: 0] : (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))
[bit: 1] : (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))
[bit: 2] : (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))
[bit: 3] : (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))
[bit: 4] : (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))
[bit: 5] : (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))
[bit: 6] : (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))
[bit: 7] : (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))
[bit: 8] : (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))
[bit: 9] : (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))
[bit:10] : (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))
[bit:11] : (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))
[bit:12] : (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))
[bit:13] : (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))
[bit:14] : (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))
[bit:15] : (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))
[bit:16] : (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))
[bit:17] : (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))
[bit:18] : (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))
[bit:19] : (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))
[bit:20] : (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))
[bit:21] : (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))
[bit:22] : (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))
[bit:23] : (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))
[bit:24] : (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))
[bit:25] : (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))
[bit:26] : (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))
[bit:27] : (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))
[bit:28] : (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))
[bit:29] : (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))
[bit:30] : (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))
[bit:31] : (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))
 
Serpent W(2):
[bit: 0] : (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))
[bit: 1] : (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))
[bit: 2] : (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))
[bit: 3] : (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))
[bit: 4] : (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))
[bit: 5] : (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))
[bit: 6] : (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))
[bit: 7] : (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))
[bit: 8] : (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)))
[bit: 9] : (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))
[bit:10] : (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))
[bit:11] : (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))
[bit:12] : (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))
[bit:13] : (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))
[bit:14] : (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))
[bit:15] : (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))
[bit:16] : (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))
[bit:17] : (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))
[bit:18] : (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))
[bit:19] : (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))
[bit:20] : (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)))
[bit:21] : (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))
[bit:22] : (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))
[bit:23] : (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))
[bit:24] : (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))
[bit:25] : (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))
[bit:26] : (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))
[bit:27] : (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))
[bit:28] : (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))
[bit:29] : (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))
[bit:30] : (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)))
[bit:31] : (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))
 
Serpent W(3):
[bit: 0] : (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10)
            (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))))
[bit: 1] : (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11)
            (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))))
[bit: 2] : (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12)
            (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))))
[bit: 3] : (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13)
            (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))))
[bit: 4] : (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14)
            (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))))
[bit: 5] : (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15)
            (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))))
[bit: 6] : (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16)
            (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))))
[bit: 7] : (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17)
            (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))))
[bit: 8] : (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18)
            (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))))
[bit: 9] : (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19)
            (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))))
[bit:10] : (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20)
            (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))))
[bit:11] : (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21)
            (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))))
[bit:12] : (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22)
            (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))))
[bit:13] : (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23)
            (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))))
[bit:14] : (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24)
            (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))))
[bit:15] : (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25)
            (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))))
[bit:16] : (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26)
            (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))))
[bit:17] : (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27)
            (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))))
[bit:18] : (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28)
            (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))))
[bit:19] : (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29)
            (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))))
[bit:20] : (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30)
            (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))))
[bit:21] : (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31)
            (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))))
[bit:22] : (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0)
            (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))))
[bit:23] : (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1)
            (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))))
[bit:24] : (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2)
            (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))))
[bit:25] : (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3)
            (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))))
[bit:26] : (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4)
            (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))))
[bit:27] : (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5)
            (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))))
[bit:28] : (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6)
            (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))))
[bit:29] : (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7)
            (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))))
[bit:30] : (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8)
            (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))))
[bit:31] : (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9)
            (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))))
 
Serpent W(4):
[bit: 0] : (XOR 1 e21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))
            (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31)
             (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))))
[bit: 1] : (XOR 0 e22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))
            (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0)
             (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))))
[bit: 2] : (XOR 0 e23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))
            (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1)
             (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))))
[bit: 3] : (XOR 0 e24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))
            (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2)
             (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))))
[bit: 4] : (XOR 1 e25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))
            (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3)
             (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))))
[bit: 5] : (XOR 1 e26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))
            (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4)
             (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))))
[bit: 6] : (XOR 1 e27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))
            (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5)
             (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))))
[bit: 7] : (XOR 1 e28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))
            (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6)
             (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))))
[bit: 8] : (XOR 0 e29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))
            (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7)
             (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))))
[bit: 9] : (XOR 0 e30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))
            (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8)
             (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))))
[bit:10] : (XOR 1 e31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))
            (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9)
             (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)))))
[bit:11] : (XOR 1 e0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))
            (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10)
             (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))))
[bit:12] : (XOR 0 e1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))
            (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11)
             (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))))
[bit:13] : (XOR 1 e2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))
            (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12)
             (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))))
[bit:14] : (XOR 1 e3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))
            (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13)
             (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))))
[bit:15] : (XOR 1 e4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))
            (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14)
             (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))))
[bit:16] : (XOR 1 e5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))
            (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15)
             (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))))
[bit:17] : (XOR 0 e6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))
            (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16)
             (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))))
[bit:18] : (XOR 1 e7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))
            (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17)
             (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))))
[bit:19] : (XOR 1 e8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))
            (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18)
             (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))))
[bit:20] : (XOR 0 e9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))
            (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19)
             (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)))))
[bit:21] : (XOR 0 e10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))
            (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20)
             (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))))
[bit:22] : (XOR 1 e11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))
            (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21)
             (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))))
[bit:23] : (XOR 1 e12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))
            (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22)
             (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))))
[bit:24] : (XOR 1 e13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))
            (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23)
             (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))))
[bit:25] : (XOR 1 e14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))
            (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24)
             (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))))
[bit:26] : (XOR 0 e15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))
            (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25)
             (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))))
[bit:27] : (XOR 1 e16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))
            (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26)
             (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))))
[bit:28] : (XOR 1 e17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))
            (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27)
             (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))))
[bit:29] : (XOR 1 e18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))
            (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28)
             (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))))
[bit:30] : (XOR 0 e19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))
            (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29)
             (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)))))
[bit:31] : (XOR 1 e20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))
            (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30)
             (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))))
 
Serpent W(5):
[bit: 0] : (XOR 1 f21 (XOR 0 a10 d10 f10 h10)
            (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))
            (XOR 0 e10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))
             (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20)
              (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))))))
[bit: 1] : (XOR 0 f22 (XOR 1 a11 d11 f11 h11)
            (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))
            (XOR 1 e11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))
             (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21)
              (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))))))
[bit: 2] : (XOR 0 f23 (XOR 1 a12 d12 f12 h12)
            (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))
            (XOR 1 e12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))
             (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22)
              (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))))))
[bit: 3] : (XOR 0 f24 (XOR 1 a13 d13 f13 h13)
            (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))
            (XOR 1 e13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))
             (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23)
              (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))))))
[bit: 4] : (XOR 1 f25 (XOR 1 a14 d14 f14 h14)
            (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))
            (XOR 1 e14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))
             (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24)
              (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))))))
[bit: 5] : (XOR 1 f26 (XOR 0 a15 d15 f15 h15)
            (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))
            (XOR 0 e15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))
             (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25)
              (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))))))
[bit: 6] : (XOR 1 f27 (XOR 1 a16 d16 f16 h16)
            (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))
            (XOR 1 e16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))
             (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26)
              (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))))))
[bit: 7] : (XOR 1 f28 (XOR 1 a17 d17 f17 h17)
            (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))
            (XOR 1 e17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))
             (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27)
              (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))))))
[bit: 8] : (XOR 0 f29 (XOR 1 a18 d18 f18 h18)
            (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))
            (XOR 1 e18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))
             (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28)
              (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))))))
[bit: 9] : (XOR 0 f30 (XOR 0 a19 d19 f19 h19)
            (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)))
            (XOR 0 e19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))
             (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29)
              (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))))))
[bit:10] : (XOR 1 f31 (XOR 1 a20 d20 f20 h20)
            (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))
            (XOR 1 e20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))
             (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30)
              (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))))))
[bit:11] : (XOR 0 f0 (XOR 1 a21 d21 f21 h21)
            (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))
            (XOR 1 e21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))
             (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31)
              (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))))))
[bit:12] : (XOR 0 f1 (XOR 0 a22 d22 f22 h22)
            (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))
            (XOR 0 e22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))
             (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0)
              (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))))))
[bit:13] : (XOR 1 f2 (XOR 0 a23 d23 f23 h23)
            (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))
            (XOR 0 e23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))
             (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1)
              (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))))))
[bit:14] : (XOR 1 f3 (XOR 0 a24 d24 f24 h24)
            (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))
            (XOR 0 e24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))
             (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2)
              (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))))))
[bit:15] : (XOR 1 f4 (XOR 1 a25 d25 f25 h25)
            (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))
            (XOR 1 e25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))
             (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3)
              (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))))))
[bit:16] : (XOR 1 f5 (XOR 1 a26 d26 f26 h26)
            (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))
            (XOR 1 e26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))
             (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4)
              (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))))))
[bit:17] : (XOR 0 f6 (XOR 1 a27 d27 f27 h27)
            (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))
            (XOR 1 e27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))
             (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5)
              (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))))))
[bit:18] : (XOR 1 f7 (XOR 1 a28 d28 f28 h28)
            (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))
            (XOR 1 e28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))
             (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6)
              (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))))))
[bit:19] : (XOR 1 f8 (XOR 0 a29 d29 f29 h29)
            (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)))
            (XOR 0 e29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))
             (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7)
              (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))))))
[bit:20] : (XOR 0 f9 (XOR 0 a30 d30 f30 h30)
            (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))
            (XOR 0 e30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))
             (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8)
              (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))))))
[bit:21] : (XOR 0 f10 (XOR 1 a31 d31 f31 h31)
            (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))
            (XOR 1 e31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))
             (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9)
              (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))))))
[bit:22] : (XOR 1 f11 (XOR 1 a0 d0 f0 h0)
            (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))
            (XOR 1 e0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))
             (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10)
              (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))))))
[bit:23] : (XOR 1 f12 (XOR 0 a1 d1 f1 h1)
            (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))
            (XOR 0 e1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))
             (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11)
              (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))))))
[bit:24] : (XOR 1 f13 (XOR 0 a2 d2 f2 h2)
            (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))
            (XOR 1 e2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))
             (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12)
              (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))))))
[bit:25] : (XOR 1 f14 (XOR 1 a3 d3 f3 h3)
            (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))
            (XOR 1 e3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))
             (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13)
              (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))))))
[bit:26] : (XOR 0 f15 (XOR 1 a4 d4 f4 h4)
            (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))
            (XOR 1 e4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))
             (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14)
              (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))))))
[bit:27] : (XOR 1 f16 (XOR 1 a5 d5 f5 h5)
            (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))
            (XOR 1 e5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))
             (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15)
              (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))))))
[bit:28] : (XOR 1 f17 (XOR 0 a6 d6 f6 h6)
            (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))
            (XOR 0 e6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))
             (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16)
              (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))))))
[bit:29] : (XOR 1 f18 (XOR 1 a7 d7 f7 h7)
            (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))
            (XOR 1 e7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))
             (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17)
              (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))))))
[bit:30] : (XOR 0 f19 (XOR 1 a8 d8 f8 h8)
            (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))
            (XOR 1 e8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))
             (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18)
              (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))))))
[bit:31] : (XOR 1 f20 (XOR 0 a9 d9 f9 h9)
            (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)))
            (XOR 0 e9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))
             (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19)
              (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))))))
 
Serpent W(6):
[bit: 0] : (XOR 1 g21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))
            (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31)
             (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))))
            (XOR 0 f10 (XOR 1 a31 d31 f31 h31)
             (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))
             (XOR 1 e31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))
              (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9)
               (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)))))))
[bit: 1] : (XOR 0 g22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))
            (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0)
             (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))))
            (XOR 1 f11 (XOR 1 a0 d0 f0 h0)
             (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))
             (XOR 1 e0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))
              (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10)
               (XOR 0 c10 f10 h10
                (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))))))
[bit: 2] : (XOR 0 g23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))
            (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1)
             (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))))
            (XOR 1 f12 (XOR 0 a1 d1 f1 h1)
             (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))
             (XOR 0 e1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))
              (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11)
               (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))))))
[bit: 3] : (XOR 0 g24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))
            (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2)
             (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))))
            (XOR 1 f13 (XOR 0 a2 d2 f2 h2)
             (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))
             (XOR 1 e2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))
              (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12)
               (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))))))
[bit: 4] : (XOR 1 g25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))
            (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3)
             (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))))
            (XOR 1 f14 (XOR 1 a3 d3 f3 h3)
             (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))
             (XOR 1 e3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))
              (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13)
               (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))))))
[bit: 5] : (XOR 1 g26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))
            (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4)
             (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))))
            (XOR 0 f15 (XOR 1 a4 d4 f4 h4)
             (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))
             (XOR 1 e4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))
              (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14)
               (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))))))
[bit: 6] : (XOR 1 g27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))
            (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5)
             (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))))
            (XOR 1 f16 (XOR 1 a5 d5 f5 h5)
             (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))
             (XOR 1 e5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))
              (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15)
               (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))))))
[bit: 7] : (XOR 1 g28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))
            (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6)
             (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))))
            (XOR 1 f17 (XOR 0 a6 d6 f6 h6)
             (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))
             (XOR 0 e6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))
              (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16)
               (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))))))
[bit: 8] : (XOR 0 g29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))
            (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7)
             (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))))
            (XOR 1 f18 (XOR 1 a7 d7 f7 h7)
             (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))
             (XOR 1 e7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))
              (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17)
               (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))))))
[bit: 9] : (XOR 0 g30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))
            (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8)
             (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))))
            (XOR 0 f19 (XOR 1 a8 d8 f8 h8)
             (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))
             (XOR 1 e8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))
              (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18)
               (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))))))
[bit:10] : (XOR 1 g31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))
            (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9)
             (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))))
            (XOR 1 f20 (XOR 0 a9 d9 f9 h9)
             (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)))
             (XOR 0 e9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))
              (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19)
               (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)))))))
[bit:11] : (XOR 1 g0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))
            (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10)
             (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))))
            (XOR 1 f21 (XOR 0 a10 d10 f10 h10)
             (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))
             (XOR 0 e10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))
              (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20)
               (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))))))
[bit:12] : (XOR 1 g1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))
            (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11)
             (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))))
            (XOR 0 f22 (XOR 1 a11 d11 f11 h11)
             (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))
             (XOR 1 e11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))
              (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21)
               (XOR 1 c21 f21 h21
                (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))))))
[bit:13] : (XOR 1 g2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))
            (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12)
             (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))))
            (XOR 0 f23 (XOR 1 a12 d12 f12 h12)
             (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))
             (XOR 1 e12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))
              (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22)
               (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))))))
[bit:14] : (XOR 1 g3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))
            (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13)
             (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))))
            (XOR 0 f24 (XOR 1 a13 d13 f13 h13)
             (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))
             (XOR 1 e13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))
              (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23)
               (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))))))
[bit:15] : (XOR 1 g4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))
            (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14)
             (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))))
            (XOR 1 f25 (XOR 1 a14 d14 f14 h14)
             (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))
             (XOR 1 e14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))
              (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24)
               (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))))))
[bit:16] : (XOR 1 g5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))
            (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15)
             (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))))
            (XOR 1 f26 (XOR 0 a15 d15 f15 h15)
             (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))
             (XOR 0 e15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))
              (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25)
               (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))))))
[bit:17] : (XOR 0 g6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))
            (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16)
             (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))))
            (XOR 1 f27 (XOR 1 a16 d16 f16 h16)
             (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))
             (XOR 1 e16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))
              (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26)
               (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))))))
[bit:18] : (XOR 1 g7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))
            (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17)
             (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))))
            (XOR 1 f28 (XOR 1 a17 d17 f17 h17)
             (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))
             (XOR 1 e17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))
              (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27)
               (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))))))
[bit:19] : (XOR 1 g8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))
            (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18)
             (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))))
            (XOR 0 f29 (XOR 1 a18 d18 f18 h18)
             (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))
             (XOR 1 e18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))
              (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28)
               (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))))))
[bit:20] : (XOR 0 g9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))
            (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19)
             (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))))
            (XOR 0 f30 (XOR 0 a19 d19 f19 h19)
             (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)))
             (XOR 0 e19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))
              (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29)
               (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)))))))
[bit:21] : (XOR 0 g10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))
            (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20)
             (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))))
            (XOR 1 f31 (XOR 1 a20 d20 f20 h20)
             (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))
             (XOR 1 e20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))
              (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30)
               (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))))))
[bit:22] : (XOR 1 g11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))
            (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21)
             (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))))
            (XOR 0 f0 (XOR 1 a21 d21 f21 h21)
             (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))
             (XOR 1 e21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))
              (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31)
               (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))))))
[bit:23] : (XOR 1 g12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))
            (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22)
             (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))))
            (XOR 0 f1 (XOR 0 a22 d22 f22 h22)
             (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))
             (XOR 0 e22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))
              (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0)
               (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))))))
[bit:24] : (XOR 1 g13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))
            (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23)
             (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))))
            (XOR 1 f2 (XOR 0 a23 d23 f23 h23)
             (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))
             (XOR 0 e23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))
              (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1)
               (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))))))
[bit:25] : (XOR 1 g14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))
            (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24)
             (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))))
            (XOR 1 f3 (XOR 0 a24 d24 f24 h24)
             (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))
             (XOR 0 e24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))
              (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2)
               (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))))))
[bit:26] : (XOR 0 g15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))
            (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25)
             (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))))
            (XOR 1 f4 (XOR 1 a25 d25 f25 h25)
             (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))
             (XOR 1 e25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))
              (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3)
               (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))))))
[bit:27] : (XOR 1 g16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))
            (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26)
             (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))))
            (XOR 1 f5 (XOR 1 a26 d26 f26 h26)
             (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))
             (XOR 1 e26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))
              (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4)
               (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))))))
[bit:28] : (XOR 1 g17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))
            (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27)
             (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))))
            (XOR 0 f6 (XOR 1 a27 d27 f27 h27)
             (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))
             (XOR 1 e27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))
              (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5)
               (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))))))
[bit:29] : (XOR 1 g18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))
            (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28)
             (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))))
            (XOR 1 f7 (XOR 1 a28 d28 f28 h28)
             (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))
             (XOR 1 e28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))
              (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6)
               (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))))))
[bit:30] : (XOR 0 g19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))
            (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29)
             (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))))
            (XOR 1 f8 (XOR 0 a29 d29 f29 h29)
             (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)))
             (XOR 0 e29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))
              (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7)
               (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))))))
[bit:31] : (XOR 1 g20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))
            (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30)
             (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))))
            (XOR 0 f9 (XOR 0 a30 d30 f30 h30)
             (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))
             (XOR 0 e30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))
              (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8)
               (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))))))
 
Serpent W(7):
[bit: 0] : (XOR 1 h21
            (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))
            (XOR 0 e10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))
             (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20)
              (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))))
            (XOR 0 g10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))
             (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20)
              (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))))
             (XOR 1 f31 (XOR 1 a20 d20 f20 h20)
              (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))
              (XOR 1 e20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))
               (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30)
                (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))))))))
[bit: 1] : (XOR 0 h22
            (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))
            (XOR 1 e11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))
             (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21)
              (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))))
            (XOR 1 g11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))
             (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21)
              (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))))
             (XOR 0 f0 (XOR 1 a21 d21 f21 h21)
              (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))
              (XOR 1 e21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))
               (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31)
                (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))))))))
[bit: 2] : (XOR 0 h23
            (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))
            (XOR 1 e12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))
             (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22)
              (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))))
            (XOR 1 g12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))
             (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22)
              (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))))
             (XOR 0 f1 (XOR 0 a22 d22 f22 h22)
              (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))
              (XOR 0 e22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))
               (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0)
                (XOR 1 c0 f0 h0
                 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))))))))
[bit: 3] : (XOR 0 h24
            (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))
            (XOR 1 e13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))
             (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23)
              (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))))
            (XOR 1 g13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))
             (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23)
              (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))))
             (XOR 1 f2 (XOR 0 a23 d23 f23 h23)
              (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))
              (XOR 0 e23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))
               (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1)
                (XOR 1 c1 f1 h1
                 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))))))))
[bit: 4] : (XOR 1 h25
            (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))
            (XOR 1 e14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))
             (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24)
              (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))))
            (XOR 1 g14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))
             (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24)
              (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))))
             (XOR 1 f3 (XOR 0 a24 d24 f24 h24)
              (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))
              (XOR 0 e24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))
               (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2)
                (XOR 0 c2 f2 h2
                 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))))))))
[bit: 5] : (XOR 1 h26
            (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))
            (XOR 0 e15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))
             (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25)
              (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))))
            (XOR 0 g15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))
             (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25)
              (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))))
             (XOR 1 f4 (XOR 1 a25 d25 f25 h25)
              (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))
              (XOR 1 e25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))
               (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3)
                (XOR 1 c3 f3 h3
                 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))))))))
[bit: 6] : (XOR 1 h27
            (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))
            (XOR 1 e16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))
             (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26)
              (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))))
            (XOR 1 g16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))
             (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26)
              (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))))
             (XOR 1 f5 (XOR 1 a26 d26 f26 h26)
              (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))
              (XOR 1 e26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))
               (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4)
                (XOR 1 c4 f4 h4
                 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))))))))
[bit: 7] : (XOR 1 h28
            (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))
            (XOR 1 e17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))
             (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27)
              (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))))
            (XOR 1 g17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))
             (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27)
              (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))))
             (XOR 0 f6 (XOR 1 a27 d27 f27 h27)
              (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))
              (XOR 1 e27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))
               (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5)
                (XOR 1 c5 f5 h5
                 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))))))))
[bit: 8] : (XOR 0 h29
            (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))
            (XOR 1 e18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))
             (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28)
              (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))))
            (XOR 1 g18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))
             (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28)
              (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))))
             (XOR 1 f7 (XOR 1 a28 d28 f28 h28)
              (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))
              (XOR 1 e28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))
               (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6)
                (XOR 0 c6 f6 h6
                 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))))))))
[bit: 9] : (XOR 0 h30
            (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)))
            (XOR 0 e19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))
             (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29)
              (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)))))
            (XOR 0 g19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))
             (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29)
              (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))))
             (XOR 1 f8 (XOR 0 a29 d29 f29 h29)
              (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)))
              (XOR 0 e29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))
               (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7)
                (XOR 1 c7 f7 h7
                 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))))))))
[bit:10] : (XOR 1 h31
            (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))
            (XOR 1 e20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))
             (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30)
              (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))))
            (XOR 1 g20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))
             (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30)
              (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))))
             (XOR 0 f9 (XOR 0 a30 d30 f30 h30)
              (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))
              (XOR 0 e30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))
               (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8)
                (XOR 1 c8 f8 h8
                 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))))))))
[bit:11] : (XOR 0 h0
            (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))
            (XOR 1 e21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))
             (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31)
              (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))))
            (XOR 1 g21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))
             (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31)
              (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))))
             (XOR 0 f10 (XOR 1 a31 d31 f31 h31)
              (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))
              (XOR 1 e31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))
               (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9)
                (XOR 0 c9 f9 h9
                 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))))))))
[bit:12] : (XOR 1 h1
            (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))
            (XOR 0 e22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))
             (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0)
              (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))))
            (XOR 0 g22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))
             (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0)
              (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))))
             (XOR 1 f11 (XOR 1 a0 d0 f0 h0)
              (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))
              (XOR 1 e0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))
               (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10)
                (XOR 0 c10 f10 h10
                 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))))))))
[bit:13] : (XOR 1 h2
            (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))
            (XOR 0 e23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))
             (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1)
              (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))))
            (XOR 0 g23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))
             (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1)
              (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))))
             (XOR 1 f12 (XOR 0 a1 d1 f1 h1)
              (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))
              (XOR 0 e1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))
               (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11)
                (XOR 1 c11 f11 h11
                 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))))))))
[bit:14] : (XOR 1 h3
            (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))
            (XOR 0 e24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))
             (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2)
              (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))))
            (XOR 0 g24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))
             (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2)
              (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))))
             (XOR 1 f13 (XOR 0 a2 d2 f2 h2)
              (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))
              (XOR 1 e2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))
               (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12)
                (XOR 1 c12 f12 h12
                 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))))))))
[bit:15] : (XOR 1 h4
            (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))
            (XOR 1 e25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))
             (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3)
              (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))))
            (XOR 1 g25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))
             (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3)
              (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))))
             (XOR 1 f14 (XOR 1 a3 d3 f3 h3)
              (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))
              (XOR 1 e3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))
               (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13)
                (XOR 1 c13 f13 h13
                 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))))))))
[bit:16] : (XOR 1 h5
            (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))
            (XOR 1 e26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))
             (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4)
              (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))))
            (XOR 1 g26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))
             (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4)
              (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))))
             (XOR 0 f15 (XOR 1 a4 d4 f4 h4)
              (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))
              (XOR 1 e4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))
               (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14)
                (XOR 1 c14 f14 h14
                 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))))))))
[bit:17] : (XOR 0 h6
            (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))
            (XOR 1 e27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))
             (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5)
              (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))))
            (XOR 1 g27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))
             (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5)
              (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))))
             (XOR 1 f16 (XOR 1 a5 d5 f5 h5)
              (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))
              (XOR 1 e5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))
               (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15)
                (XOR 0 c15 f15 h15
                 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))))))))
[bit:18] : (XOR 1 h7
            (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))
            (XOR 1 e28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))
             (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6)
              (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))))
            (XOR 1 g28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))
             (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6)
              (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))))
             (XOR 1 f17 (XOR 0 a6 d6 f6 h6)
              (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))
              (XOR 0 e6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))
               (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16)
                (XOR 1 c16 f16 h16
                 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))))))))
[bit:19] : (XOR 1 h8
            (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)))
            (XOR 0 e29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))
             (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7)
              (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))))
            (XOR 0 g29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))
             (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7)
              (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))))
             (XOR 1 f18 (XOR 1 a7 d7 f7 h7)
              (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))
              (XOR 1 e7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))
               (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17)
                (XOR 1 c17 f17 h17
                 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))))))))
[bit:20] : (XOR 0 h9
            (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))
            (XOR 0 e30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))
             (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8)
              (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))))
            (XOR 0 g30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))
             (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8)
              (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))))
             (XOR 0 f19 (XOR 1 a8 d8 f8 h8)
              (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))
              (XOR 1 e8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))
               (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18)
                (XOR 1 c18 f18 h18
                 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))))))))
[bit:21] : (XOR 0 h10
            (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))
            (XOR 1 e31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))
             (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9)
              (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)))))
            (XOR 1 g31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))
             (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9)
              (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))))
             (XOR 1 f20 (XOR 0 a9 d9 f9 h9)
              (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)))
              (XOR 0 e9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))
               (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19)
                (XOR 0 c19 f19 h19
                 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))))))))
[bit:22] : (XOR 1 h11
            (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))
            (XOR 1 e0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))
             (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10)
              (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))))
            (XOR 1 g0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))
             (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10)
              (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))))
             (XOR 1 f21 (XOR 0 a10 d10 f10 h10)
              (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))
              (XOR 0 e10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))
               (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20)
                (XOR 1 c20 f20 h20
                 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))))))))
[bit:23] : (XOR 1 h12
            (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))
            (XOR 0 e1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))
             (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11)
              (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))))
            (XOR 1 g1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))
             (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11)
              (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))))
             (XOR 0 f22 (XOR 1 a11 d11 f11 h11)
              (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))
              (XOR 1 e11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))
               (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21)
                (XOR 1 c21 f21 h21
                 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))))))))
[bit:24] : (XOR 1 h13
            (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))
            (XOR 1 e2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))
             (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12)
              (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))))
            (XOR 1 g2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))
             (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12)
              (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))))
             (XOR 0 f23 (XOR 1 a12 d12 f12 h12)
              (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))
              (XOR 1 e12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))
               (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22)
                (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))))))))
[bit:25] : (XOR 1 h14
            (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))
            (XOR 1 e3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))
             (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13)
              (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))))
            (XOR 1 g3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))
             (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13)
              (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))))
             (XOR 0 f24 (XOR 1 a13 d13 f13 h13)
              (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))
              (XOR 1 e13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))
               (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23)
                (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))))))))
[bit:26] : (XOR 0 h15
            (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))
            (XOR 1 e4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))
             (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14)
              (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))))
            (XOR 1 g4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))
             (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14)
              (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))))
             (XOR 1 f25 (XOR 1 a14 d14 f14 h14)
              (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))
              (XOR 1 e14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))
               (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24)
                (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))))))))
[bit:27] : (XOR 1 h16
            (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))
            (XOR 1 e5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))
             (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15)
              (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))))
            (XOR 1 g5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))
             (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15)
              (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))))
             (XOR 1 f26 (XOR 0 a15 d15 f15 h15)
              (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))
              (XOR 0 e15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))
               (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25)
                (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))))))))
[bit:28] : (XOR 1 h17
            (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))
            (XOR 0 e6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))
             (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16)
              (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))))
            (XOR 0 g6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))
             (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16)
              (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))))
             (XOR 1 f27 (XOR 1 a16 d16 f16 h16)
              (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))
              (XOR 1 e16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))
               (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26)
                (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))))))))
[bit:29] : (XOR 1 h18
            (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))
            (XOR 1 e7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))
             (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17)
              (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))))
            (XOR 1 g7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))
             (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17)
              (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))))
             (XOR 1 f28 (XOR 1 a17 d17 f17 h17)
              (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))
              (XOR 1 e17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))
               (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27)
                (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))))))))
[bit:30] : (XOR 0 h19
            (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))
            (XOR 1 e8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))
             (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18)
              (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))))
            (XOR 1 g8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))
             (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18)
              (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))))
             (XOR 0 f29 (XOR 1 a18 d18 f18 h18)
              (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))
              (XOR 1 e18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))
               (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28)
                (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))))))))
[bit:31] : (XOR 1 h20
            (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)))
            (XOR 0 e9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))
             (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19)
              (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)))))
            (XOR 0 g9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))
             (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19)
              (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))))
             (XOR 0 f30 (XOR 0 a19 d19 f19 h19)
              (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)))
              (XOR 0 e19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))
               (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29)
                (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))))))))
 
Serpent W(8):
[bit: 0] : (XOR 1 (XOR 0 a10 d10 f10 h10)
            (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31)
             (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))))
            (XOR 0 f10 (XOR 1 a31 d31 f31 h31)
             (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))
             (XOR 1 e31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))
              (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9)
               (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))))))
            (XOR 0 h10
             (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))
             (XOR 1 e31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))
              (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9)
               (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)))))
             (XOR 1 g31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))
              (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9)
               (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))))
              (XOR 1 f20 (XOR 0 a9 d9 f9 h9)
               (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)))
               (XOR 0 e9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))
                (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19)
                 (XOR 0 c19 f19 h19
                  (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)))))))))
[bit: 1] : (XOR 0 (XOR 1 a11 d11 f11 h11)
            (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0)
             (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))))
            (XOR 1 f11 (XOR 1 a0 d0 f0 h0)
             (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))
             (XOR 1 e0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))
              (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10)
               (XOR 0 c10 f10 h10
                (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))))))
            (XOR 1 h11
             (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))
             (XOR 1 e0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))
              (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10)
               (XOR 0 c10 f10 h10
                (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))))
             (XOR 1 g0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))
              (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10)
               (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))))
              (XOR 1 f21 (XOR 0 a10 d10 f10 h10)
               (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))
               (XOR 0 e10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))
                (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20)
                 (XOR 1 c20 f20 h20
                  (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))))))))
[bit: 2] : (XOR 0 (XOR 1 a12 d12 f12 h12)
            (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1)
             (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))))
            (XOR 1 f12 (XOR 0 a1 d1 f1 h1)
             (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))
             (XOR 0 e1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))
              (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11)
               (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))))))
            (XOR 1 h12
             (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))
             (XOR 0 e1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))
              (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11)
               (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))))
             (XOR 1 g1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))
              (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11)
               (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))))
              (XOR 0 f22 (XOR 1 a11 d11 f11 h11)
               (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))
               (XOR 1 e11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))
                (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21)
                 (XOR 1 c21 f21 h21
                  (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))))))))
[bit: 3] : (XOR 0 (XOR 1 a13 d13 f13 h13)
            (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2)
             (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))))
            (XOR 1 f13 (XOR 0 a2 d2 f2 h2)
             (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))
             (XOR 1 e2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))
              (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12)
               (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))))))
            (XOR 1 h13
             (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))
             (XOR 1 e2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))
              (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12)
               (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))))
             (XOR 1 g2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))
              (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12)
               (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))))
              (XOR 0 f23 (XOR 1 a12 d12 f12 h12)
               (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))
               (XOR 1 e12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))
                (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22)
                 (XOR 0 c22 f22 h22
                  (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))))))))
[bit: 4] : (XOR 1 (XOR 1 a14 d14 f14 h14)
            (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3)
             (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))))
            (XOR 1 f14 (XOR 1 a3 d3 f3 h3)
             (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))
             (XOR 1 e3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))
              (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13)
               (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))))))
            (XOR 1 h14
             (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))
             (XOR 1 e3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))
              (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13)
               (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))))
             (XOR 1 g3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))
              (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13)
               (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))))
              (XOR 0 f24 (XOR 1 a13 d13 f13 h13)
               (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))
               (XOR 1 e13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))
                (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23)
                 (XOR 0 c23 f23 h23
                  (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))))))))
[bit: 5] : (XOR 1 (XOR 0 a15 d15 f15 h15)
            (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4)
             (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))))
            (XOR 0 f15 (XOR 1 a4 d4 f4 h4)
             (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))
             (XOR 1 e4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))
              (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14)
               (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))))))
            (XOR 0 h15
             (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))
             (XOR 1 e4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))
              (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14)
               (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))))
             (XOR 1 g4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))
              (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14)
               (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))))
              (XOR 1 f25 (XOR 1 a14 d14 f14 h14)
               (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))
               (XOR 1 e14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))
                (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24)
                 (XOR 0 c24 f24 h24
                  (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))))))))
[bit: 6] : (XOR 1 (XOR 1 a16 d16 f16 h16)
            (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5)
             (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))))
            (XOR 1 f16 (XOR 1 a5 d5 f5 h5)
             (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))
             (XOR 1 e5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))
              (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15)
               (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))))))
            (XOR 1 h16
             (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))
             (XOR 1 e5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))
              (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15)
               (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))))
             (XOR 1 g5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))
              (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15)
               (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))))
              (XOR 1 f26 (XOR 0 a15 d15 f15 h15)
               (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))
               (XOR 0 e15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))
                (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25)
                 (XOR 1 c25 f25 h25
                  (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))))))))
[bit: 7] : (XOR 1 (XOR 1 a17 d17 f17 h17)
            (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6)
             (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))))
            (XOR 1 f17 (XOR 0 a6 d6 f6 h6)
             (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))
             (XOR 0 e6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))
              (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16)
               (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))))))
            (XOR 1 h17
             (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))
             (XOR 0 e6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))
              (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16)
               (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))))
             (XOR 0 g6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))
              (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16)
               (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))))
              (XOR 1 f27 (XOR 1 a16 d16 f16 h16)
               (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))
               (XOR 1 e16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))
                (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26)
                 (XOR 1 c26 f26 h26
                  (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))))))))
[bit: 8] : (XOR 0 (XOR 1 a18 d18 f18 h18)
            (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7)
             (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))))
            (XOR 1 f18 (XOR 1 a7 d7 f7 h7)
             (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))
             (XOR 1 e7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))
              (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17)
               (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))))))
            (XOR 1 h18
             (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))
             (XOR 1 e7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))
              (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17)
               (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))))
             (XOR 1 g7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))
              (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17)
               (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))))
              (XOR 1 f28 (XOR 1 a17 d17 f17 h17)
               (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))
               (XOR 1 e17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))
                (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27)
                 (XOR 1 c27 f27 h27
                  (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))))))))
[bit: 9] : (XOR 0 (XOR 0 a19 d19 f19 h19)
            (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8)
             (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))))
            (XOR 0 f19 (XOR 1 a8 d8 f8 h8)
             (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))
             (XOR 1 e8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))
              (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18)
               (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))))))
            (XOR 0 h19
             (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))
             (XOR 1 e8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))
              (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18)
               (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))))
             (XOR 1 g8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))
              (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18)
               (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))))
              (XOR 0 f29 (XOR 1 a18 d18 f18 h18)
               (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))
               (XOR 1 e18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))
                (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28)
                 (XOR 1 c28 f28 h28
                  (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))))))))
[bit:10] : (XOR 1 (XOR 1 a20 d20 f20 h20)
            (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9)
             (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))))
            (XOR 1 f20 (XOR 0 a9 d9 f9 h9)
             (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)))
             (XOR 0 e9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))
              (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19)
               (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))))))
            (XOR 1 h20
             (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)))
             (XOR 0 e9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))
              (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19)
               (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)))))
             (XOR 0 g9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))
              (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19)
               (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))))
              (XOR 0 f30 (XOR 0 a19 d19 f19 h19)
               (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)))
               (XOR 0 e19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))
                (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29)
                 (XOR 0 c29 f29 h29
                  (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)))))))))
[bit:11] : (XOR 1 (XOR 1 a21 d21 f21 h21)
            (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10)
             (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))))
            (XOR 1 f21 (XOR 0 a10 d10 f10 h10)
             (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))
             (XOR 0 e10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))
              (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20)
               (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))))))
            (XOR 1 h21
             (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))
             (XOR 0 e10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))
              (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20)
               (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))))
             (XOR 0 g10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))
              (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20)
               (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))))
              (XOR 1 f31 (XOR 1 a20 d20 f20 h20)
               (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))
               (XOR 1 e20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))
                (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30)
                 (XOR 0 c30 f30 h30
                  (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))))))))
[bit:12] : (XOR 0 (XOR 0 a22 d22 f22 h22)
            (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11)
             (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))))
            (XOR 0 f22 (XOR 1 a11 d11 f11 h11)
             (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))
             (XOR 1 e11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))
              (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21)
               (XOR 1 c21 f21 h21
                (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))))))
            (XOR 0 h22
             (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))
             (XOR 1 e11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))
              (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21)
               (XOR 1 c21 f21 h21
                (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))))
             (XOR 1 g11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))
              (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21)
               (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))))
              (XOR 0 f0 (XOR 1 a21 d21 f21 h21)
               (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))
               (XOR 1 e21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))
                (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31)
                 (XOR 1 c31 f31 h31
                  (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))))))))
[bit:13] : (XOR 0 (XOR 0 a23 d23 f23 h23)
            (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12)
             (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))))
            (XOR 0 f23 (XOR 1 a12 d12 f12 h12)
             (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))
             (XOR 1 e12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))
              (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22)
               (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))))))
            (XOR 0 h23
             (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))
             (XOR 1 e12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))
              (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22)
               (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))))
             (XOR 1 g12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))
              (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22)
               (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))))
              (XOR 0 f1 (XOR 0 a22 d22 f22 h22)
               (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))
               (XOR 0 e22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))
                (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0)
                 (XOR 1 c0 f0 h0
                  (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))))))))
[bit:14] : (XOR 0 (XOR 0 a24 d24 f24 h24)
            (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13)
             (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))))
            (XOR 0 f24 (XOR 1 a13 d13 f13 h13)
             (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))
             (XOR 1 e13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))
              (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23)
               (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))))))
            (XOR 0 h24
             (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))
             (XOR 1 e13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))
              (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23)
               (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))))
             (XOR 1 g13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))
              (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23)
               (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))))
              (XOR 1 f2 (XOR 0 a23 d23 f23 h23)
               (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))
               (XOR 0 e23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))
                (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1)
                 (XOR 1 c1 f1 h1
                  (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))))))))
[bit:15] : (XOR 1 (XOR 1 a25 d25 f25 h25)
            (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14)
             (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))))
            (XOR 1 f25 (XOR 1 a14 d14 f14 h14)
             (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))
             (XOR 1 e14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))
              (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24)
               (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))))))
            (XOR 1 h25
             (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))
             (XOR 1 e14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))
              (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24)
               (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))))
             (XOR 1 g14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))
              (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24)
               (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))))
              (XOR 1 f3 (XOR 0 a24 d24 f24 h24)
               (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))
               (XOR 0 e24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))
                (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2)
                 (XOR 0 c2 f2 h2
                  (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))))))))
[bit:16] : (XOR 1 (XOR 1 a26 d26 f26 h26)
            (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15)
             (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))))
            (XOR 1 f26 (XOR 0 a15 d15 f15 h15)
             (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))
             (XOR 0 e15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))
              (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25)
               (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))))))
            (XOR 1 h26
             (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))
             (XOR 0 e15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))
              (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25)
               (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))))
             (XOR 0 g15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))
              (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25)
               (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))))
              (XOR 1 f4 (XOR 1 a25 d25 f25 h25)
               (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))
               (XOR 1 e25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))
                (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3)
                 (XOR 1 c3 f3 h3
                  (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))))))))
[bit:17] : (XOR 0 (XOR 1 a27 d27 f27 h27)
            (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16)
             (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))))
            (XOR 1 f27 (XOR 1 a16 d16 f16 h16)
             (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))
             (XOR 1 e16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))
              (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26)
               (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))))))
            (XOR 1 h27
             (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))
             (XOR 1 e16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))
              (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26)
               (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))))
             (XOR 1 g16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))
              (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26)
               (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))))
              (XOR 1 f5 (XOR 1 a26 d26 f26 h26)
               (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))
               (XOR 1 e26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))
                (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4)
                 (XOR 1 c4 f4 h4
                  (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))))))))
[bit:18] : (XOR 1 (XOR 1 a28 d28 f28 h28)
            (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17)
             (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))))
            (XOR 1 f28 (XOR 1 a17 d17 f17 h17)
             (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))
             (XOR 1 e17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))
              (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27)
               (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))))))
            (XOR 1 h28
             (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))
             (XOR 1 e17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))
              (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27)
               (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))))
             (XOR 1 g17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))
              (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27)
               (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))))
              (XOR 0 f6 (XOR 1 a27 d27 f27 h27)
               (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))
               (XOR 1 e27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))
                (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5)
                 (XOR 1 c5 f5 h5
                  (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))))))))
[bit:19] : (XOR 1 (XOR 0 a29 d29 f29 h29)
            (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18)
             (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))))
            (XOR 0 f29 (XOR 1 a18 d18 f18 h18)
             (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))
             (XOR 1 e18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))
              (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28)
               (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))))))
            (XOR 0 h29
             (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))
             (XOR 1 e18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))
              (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28)
               (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))))
             (XOR 1 g18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))
              (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28)
               (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))))
              (XOR 1 f7 (XOR 1 a28 d28 f28 h28)
               (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))
               (XOR 1 e28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))
                (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6)
                 (XOR 0 c6 f6 h6
                  (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))))))))
[bit:20] : (XOR 0 (XOR 0 a30 d30 f30 h30)
            (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19)
             (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))))
            (XOR 0 f30 (XOR 0 a19 d19 f19 h19)
             (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)))
             (XOR 0 e19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))
              (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29)
               (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))))))
            (XOR 0 h30
             (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)))
             (XOR 0 e19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))
              (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29)
               (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)))))
             (XOR 0 g19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))
              (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29)
               (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))))
              (XOR 1 f8 (XOR 0 a29 d29 f29 h29)
               (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)))
               (XOR 0 e29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))
                (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7)
                 (XOR 1 c7 f7 h7
                  (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))))))))
[bit:21] : (XOR 0 (XOR 1 a31 d31 f31 h31)
            (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20)
             (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))))
            (XOR 1 f31 (XOR 1 a20 d20 f20 h20)
             (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))
             (XOR 1 e20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))
              (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30)
               (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))))))
            (XOR 1 h31
             (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))
             (XOR 1 e20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))
              (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30)
               (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))))
             (XOR 1 g20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))
              (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30)
               (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))))
              (XOR 0 f9 (XOR 0 a30 d30 f30 h30)
               (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))
               (XOR 0 e30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))
                (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8)
                 (XOR 1 c8 f8 h8
                  (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))))))))
[bit:22] : (XOR 1 (XOR 1 a0 d0 f0 h0)
            (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21)
             (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))))
            (XOR 0 f0 (XOR 1 a21 d21 f21 h21)
             (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))
             (XOR 1 e21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))
              (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31)
               (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))))))
            (XOR 0 h0
             (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))
             (XOR 1 e21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))
              (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31)
               (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))))
             (XOR 1 g21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))
              (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31)
               (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))))
              (XOR 0 f10 (XOR 1 a31 d31 f31 h31)
               (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))
               (XOR 1 e31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))
                (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9)
                 (XOR 0 c9 f9 h9
                  (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)))))))))
[bit:23] : (XOR 1 (XOR 0 a1 d1 f1 h1)
            (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22)
             (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))))
            (XOR 0 f1 (XOR 0 a22 d22 f22 h22)
             (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))
             (XOR 0 e22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))
              (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0)
               (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))))))
            (XOR 1 h1
             (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))
             (XOR 0 e22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))
              (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0)
               (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))))
             (XOR 0 g22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))
              (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0)
               (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))))
              (XOR 1 f11 (XOR 1 a0 d0 f0 h0)
               (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))
               (XOR 1 e0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))
                (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10)
                 (XOR 0 c10 f10 h10
                  (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))))))))
[bit:24] : (XOR 1 (XOR 0 a2 d2 f2 h2)
            (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23)
             (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))))
            (XOR 1 f2 (XOR 0 a23 d23 f23 h23)
             (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))
             (XOR 0 e23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))
              (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1)
               (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))))))
            (XOR 1 h2
             (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))
             (XOR 0 e23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))
              (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1)
               (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))))
             (XOR 0 g23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))
              (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1)
               (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))))
              (XOR 1 f12 (XOR 0 a1 d1 f1 h1)
               (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))
               (XOR 0 e1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))
                (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11)
                 (XOR 1 c11 f11 h11
                  (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))))))))
[bit:25] : (XOR 1 (XOR 1 a3 d3 f3 h3)
            (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24)
             (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))))
            (XOR 1 f3 (XOR 0 a24 d24 f24 h24)
             (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))
             (XOR 0 e24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))
              (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2)
               (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))))))
            (XOR 1 h3
             (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))
             (XOR 0 e24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))
              (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2)
               (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))))
             (XOR 0 g24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))
              (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2)
               (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))))
              (XOR 1 f13 (XOR 0 a2 d2 f2 h2)
               (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))
               (XOR 1 e2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))
                (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12)
                 (XOR 1 c12 f12 h12
                  (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))))))))
[bit:26] : (XOR 0 (XOR 1 a4 d4 f4 h4)
            (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25)
             (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))))
            (XOR 1 f4 (XOR 1 a25 d25 f25 h25)
             (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))
             (XOR 1 e25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))
              (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3)
               (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))))))
            (XOR 1 h4
             (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))
             (XOR 1 e25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))
              (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3)
               (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))))
             (XOR 1 g25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))
              (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3)
               (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))))
              (XOR 1 f14 (XOR 1 a3 d3 f3 h3)
               (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))
               (XOR 1 e3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))
                (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13)
                 (XOR 1 c13 f13 h13
                  (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))))))))
[bit:27] : (XOR 1 (XOR 1 a5 d5 f5 h5)
            (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26)
             (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))))
            (XOR 1 f5 (XOR 1 a26 d26 f26 h26)
             (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))
             (XOR 1 e26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))
              (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4)
               (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))))))
            (XOR 1 h5
             (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))
             (XOR 1 e26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))
              (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4)
               (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))))
             (XOR 1 g26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))
              (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4)
               (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))))
              (XOR 0 f15 (XOR 1 a4 d4 f4 h4)
               (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))
               (XOR 1 e4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))
                (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14)
                 (XOR 1 c14 f14 h14
                  (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))))))))
[bit:28] : (XOR 1 (XOR 0 a6 d6 f6 h6)
            (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27)
             (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))))
            (XOR 0 f6 (XOR 1 a27 d27 f27 h27)
             (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))
             (XOR 1 e27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))
              (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5)
               (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))))))
            (XOR 0 h6
             (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))
             (XOR 1 e27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))
              (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5)
               (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))))
             (XOR 1 g27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))
              (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5)
               (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))))
              (XOR 1 f16 (XOR 1 a5 d5 f5 h5)
               (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))
               (XOR 1 e5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))
                (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15)
                 (XOR 0 c15 f15 h15
                  (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))))))))
[bit:29] : (XOR 1 (XOR 1 a7 d7 f7 h7)
            (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28)
             (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))))
            (XOR 1 f7 (XOR 1 a28 d28 f28 h28)
             (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))
             (XOR 1 e28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))
              (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6)
               (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))))))
            (XOR 1 h7
             (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))
             (XOR 1 e28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))
              (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6)
               (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))))
             (XOR 1 g28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))
              (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6)
               (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))))
              (XOR 1 f17 (XOR 0 a6 d6 f6 h6)
               (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))
               (XOR 0 e6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))
                (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16)
                 (XOR 1 c16 f16 h16
                  (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))))))))
[bit:30] : (XOR 0 (XOR 1 a8 d8 f8 h8)
            (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29)
             (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))))
            (XOR 1 f8 (XOR 0 a29 d29 f29 h29)
             (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)))
             (XOR 0 e29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))
              (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7)
               (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))))))
            (XOR 1 h8
             (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)))
             (XOR 0 e29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))
              (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7)
               (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))))
             (XOR 0 g29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))
              (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7)
               (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))))
              (XOR 1 f18 (XOR 1 a7 d7 f7 h7)
               (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))
               (XOR 1 e7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))
                (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17)
                 (XOR 1 c17 f17 h17
                  (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))))))))
[bit:31] : (XOR 1 (XOR 0 a9 d9 f9 h9)
            (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30)
             (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))))
            (XOR 0 f9 (XOR 0 a30 d30 f30 h30)
             (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))
             (XOR 0 e30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))
              (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8)
               (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))))))
            (XOR 0 h9
             (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))
             (XOR 0 e30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))
              (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8)
               (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))))
             (XOR 0 g30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))
              (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8)
               (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))))
              (XOR 0 f19 (XOR 1 a8 d8 f8 h8)
               (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))
               (XOR 1 e8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))
                (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18)
                 (XOR 1 c18 f18 h18
                  (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))))))))

Still needs an elementary term-combining algebraic simplifier. Then, potentially we learn the answer to the puzzler of whether there are in fact 2**256 possible 528-byte expanded keys.

~To be continued!~

Serpent in ICE40, Part 2.


This article is a continuation of “Can the Serpent Cipher fit in the ICE40 FPGA?”.

Below is a revision of the forward S-box of Serpent from the previous article, with all of the S-Box equations rewritten in the same form, i.e. using strictly AND, OR, and NOT operations, with none having more than six subclauses, and reformatted for clarity:

module sbox_forward(clk, fire, box_n,
                    a, b, c, d,
                    w, x, y, z);
   // clock
   input wire clk;
 
   // trigger
   input wire fire;
 
   // number of sbox
   input [3:0] box_n;
 
   // inputs
   input [31:0] a;
   input [31:0] b;
   input [31:0] c;
   input [31:0] d;
 
   // outputs
   output reg [31:0] w = 0;
   output reg [31:0] x = 0;
   output reg [31:0] y = 0;
   output reg [31:0] z = 0;
 
   always @(posedge clk)
     if (fire)
       begin
          begin
             case (box_n)
               /////////////////////////////////
    	       4'd0:
                 begin
                    w < = ( a & ~b & ~c &  d) | 
                         (~a &       c &  d) | 
                         (~a &      ~c & ~d) | 
                         (      b &      ~d);
 
                    x <= ( a &  b & ~c &  d) |
                         ( a &       c & ~d) |
                         (~a & ~b          ) |
                         (~a &      ~c & ~d);
 
                    y <= ( a &  b &  c &  d) |
                         ( a & ~b &  c & ~d) |
                         (~a &  b &      ~d) |
                         (~a & ~b &       d) |
                         (~a &      ~c &  d) |
                         (     ~b & ~c &  d);
 
                    z <= ( a &  b &  c     ) |
                         ( a & ~b & ~c     ) |
                         (~a &  b & ~c & ~d) | 
                         (~a & ~b &  c & ~d) |
                         (      b &  c &  d) |
                         (     ~b & ~c &  d);
                 end
               /////////////////////////////////
    	       4'd1:
                 begin
                    w <= ( a &  b & ~c & ~d) |
                         ( a & ~b      &  d) |
                         (~a &  b &  c     ) |
                         (~a & ~b & ~c     ) |
                         (~a & ~b      & ~d);
 
                    x <= ( a &  b      & ~d) |
                         ( a & ~b & ~c &  d) |
                         (~a &  b      &  d) |
                         (~a &       c &  d) |
                         (~a &      ~c & ~d);
 
                    y <= ( a &       c &  d) |
                         ( a &      ~c & ~d) |
                         (~a &  b &  c & ~d) |
                         (~a &  b & ~c &  d) |
                         (     ~b &  c &  d) |
                         (     ~b & ~c & ~d);
 
                    z <= ( a &  b &  c & ~d) |
                         ( a & ~b &       d) |
                         (~a & ~b &      ~d) |
                         (      b & ~c &  d) |
                         (     ~b & ~c & ~d);
                 end
               /////////////////////////////////
    	       4'd2:
                 begin
                    w <= ( a &  b &      ~d) |
                         ( a & ~b &       d) |
                         (~a &  b &  c &  d) |
                         (~a & ~b &  c & ~d) |
                         (      b & ~c & ~d) |
                         (     ~b & ~c &  d);
 
                    x <= ( a & ~b & ~c & ~d) |
                         ( a &       c &  d) |
                         (~a &  b & ~c     ) |
                         (~a &       c & ~d) |
                         (      b &  c & ~d);
 
                    y <= ( a & ~b &      ~d) |
                         ( a &       c & ~d) |
                         (~a &  b & ~c     ) |
                         (~a &  b &       d) |
                         (~a &      ~c &  d) |
                         (      b & ~c &  d);
 
                    z <= ( a &  b &      ~d) |
                         ( a & ~b &  c     ) |
                         (~a & ~b & ~c     ) |
                         (~a &      ~c &  d) |
                         (      b &  c & ~d);
                 end
               /////////////////////////////////
    	       4'd3:
                 begin
                    w <= ( a & ~b          ) | 
                         ( a &       c & ~d) |
                         (~a &  b &  c &  d) |
                         (~a &  b & ~c & ~d) |
                         (     ~b & ~c &  d);
 
                    x <= ( a &  b &  c     ) |
                         ( a & ~b & ~c & ~d) |
                         (~a &  b & ~c     ) |
                         (      b &  c & ~d) |
                         (     ~b &  c &  d);
 
                    y <= ( a &  b &       d) |
                         ( a & ~b & ~c & ~d) |
                         ( a &       c &  d) |
                         (~a &  b &  c     ) |
                         (~a & ~b & ~c &  d) |
                         (~a &       c & ~d);
 
                    z <= ( a &  b &  c &  d) |
                         ( a & ~b &      ~d) |
                         (~a & ~b &       d) |
                         (      b & ~c & ~d) |
                         (     ~b &  c & ~d);
                 end
               /////////////////////////////////
    	       4'd4:
                 begin
                    w <= ( a & ~b & ~c     ) | 
                         ( a &      ~c & ~d) | 
                         (~a &  b &  c     ) |
                         (~a &       c &  d) | 
                         (      b &  c &  d) | 
                         (     ~b & ~c & ~d);
 
                    x <= ( a &  b & ~c     ) |
                         ( a & ~b &  c &  d) |
                         ( a &      ~c & ~d) |
                         (~a &  b &  c     ) |
                         (~a & ~b & ~c &  d) |
                         (      b &  c & ~d);
 
                    y <= ( a &  b &  c     ) |
                         ( a & ~b & ~c     ) |
                         ( a & ~b &       d) |
                         (~a &  b &       d) |
                         (~a & ~b &  c & ~d);
 
                    z <= ( a &  b &       d) |
                         ( a & ~b & ~c & ~d) |
                         (~a &  b &      ~d) |
                         (~a & ~b &  c     ) |
                         (     ~b &  c &  d);
 
                 end
               /////////////////////////////////
    	       4'd5:
                 begin
                    w <= ( a & ~b & ~c     ) |
                         ( a &      ~c & ~d) |
                         (~a &  b &  c     ) |
                         (~a &       c &  d) |
                         (      b &  c &  d) |
                         (     ~b & ~c & ~d);
 
                    x <= ( a & ~b &  c     ) |
                         ( a & ~b &       d) |
                         (~a &  b &       d) |
                         (~a &      ~c & ~d) |
                         (      b & ~c & ~d);
 
                    y <= ( a &  b &  c & ~d) |
                         (~a &  b &       d) |
                         (~a & ~b &  c     ) |
                         (     ~b &  c &  d) |
                         (     ~b & ~c & ~d);
 
                    z <= ( a &  b & ~c     ) |
                         ( a &       c & ~d) |
                         (~a & ~b &  c &  d) |
                         (~a & ~b & ~c & ~d) |
                         (      b &  c & ~d) |
                         (      b & ~c &  d);
                 end
               /////////////////////////////////
    	       4'd6:
                 begin
                    w <= ( a &  b &      ~d) |
                         ( a &      ~c &  d) |
                         (~a & ~b & ~c & ~d) |
                         (      b & ~c &  d) |
                         (     ~b &  c &  d);
 
                    x <= ( a &  b & ~c &  d) |
                         ( a & ~b &  c &  d) |
                         (~a &  b &  c     ) |
                         (~a & ~b & ~c     ) |
                         (      b &  c & ~d) |
                         (     ~b & ~c & ~d);
 
                    y <= ( a &  b & ~c     ) |
                         ( a & ~b &  c & ~d) |
                         (~a &  b &      ~d) |
                         (~a & ~b & ~c     ) |
                         (~a & ~b &       d);
 
                    z <= ( a &  b &  c & ~d) |
                         ( a &      ~c &  d) |
                         (~a &  b & ~c & ~d) |
                         (~a & ~b &  c     ) |
                         (~a &       c &  d) |
                         (     ~b & ~c &  d);
                 end
               /////////////////////////////////
    	       4'd7:
                 begin
                    w <= ( a &  b &  c & ~d) |
                         (~a & ~b & ~c     ) |
                         (~a &       c &  d) |
                         (~a &      ~c & ~d) |
                         (     ~b &  c &  d) |
                         (     ~b & ~c & ~d);
 
                    x <= ( a &  b &  c     ) |
                         ( a &  b &       d) |
                         ( a &       c &  d) |
                         (~a &  b &      ~d) |
                         (~a & ~b & ~c &  d) |
                         (~a &       c & ~d);
 
                    y <= ( a & ~b & ~c     ) |
                         (~a &  b & ~c     ) |
                         (~a & ~b &  c & ~d) |
                         (~a &      ~c &  d) |
                         (      b &  c &  d);
 
                    z <= ( a & ~b &      ~d) |
                         ( a &       c & ~d) | 
                         (~a &  b & ~c     ) |
                         (~a & ~b &  c     ) |
                         (      b & ~c &  d);
 
                 end
               /////////////////////////////////
             endcase // case (box_n)
          end
       end
endmodule

This formulation produces the same test output as previously noted.

Potentially this will make it possible to determine a more compact circuit representation (e.g. one making use of a RAM table populated with constants, on top of a MUX).

~To be continued!~

Can the Serpent Cipher fit in the ICE40 FPGA?

The question of whether the Serpent cipher could fit in a ICE40 FPGA was posed recently, and my first thought was: why not bake what appears to be the heaviest moving part, and see how many gates it requires? Then it will be possible to estimate whether the entire thing is worth baking. (I have very little interest in using again any FPGA other than ICE40, unless another reversing breakthrough, concerning a larger chip, is made public.)

And so I took the forward S-box of Serpent and came up with the following:

module sbox_forward(clk, fire, box_n,
                    a, b, c, d,
                    w, x, y, z);
   // clock
   input wire clk;
 
   // trigger
   input wire fire;
 
   // number of sbox
   input [3:0] box_n;
 
   // inputs
   input [31:0] a;
   input [31:0] b;
   input [31:0] c;
   input [31:0] d;
 
   // outputs
   output reg [31:0] w = 0;
   output reg [31:0] x = 0;
   output reg [31:0] y = 0;
   output reg [31:0] z = 0;
 
   always @(posedge clk)
     if (fire)
       begin
          begin
             case (box_n)
               /////////////////////////////////
    	       4'd0:
                 begin
                    w < = ( a  & ~b & ~c &  d) |
                          (~a &        c &  d) |
                          (~a &       ~c & ~d) |
                          (       b &      ~d);
 
                    x <= ( a &   b & ~c &  d)  |
                         ( a &        c & ~d)  |
                         (~a &  ~b)            |
                         (~a &       ~c & ~d);
 
                    y <= ((~b | c) & d)       ^
                         ((a ^ b) & (b | c));
 
                    z <= b ^ c ^ (a | d);
                 end
               /////////////////////////////////
    	       4'd1:
                 begin
                    w <= ( a &  b & ~c & ~d) |
                         ( a & ~b      &  d) |
                         (~a &  b &  c)      |
                         (~a & ~b & ~c)      |
                         (~a & ~b      & ~d);
 
                    x <= ( a &  b      & ~d) |
                         ( a & ~b & ~c &  d) |
                         (~a &  b      &  d) |
                         (~a &       c &  d) |
                         (~a &      ~c & ~d);
 
                    y <= c ^ d ^ (a | ~b);
 
                    z <= ( a &  b &  c & ~d) |
                         ( a & ~b &       d) |
                         (~a & ~b &      ~d) |
                         (      b & ~c &  d) |
                         (     ~b & ~c & ~d);
                 end
               /////////////////////////////////
    	       4'd2:
                 begin
                    w <= a ^ b ^ d ^ (a | c);
 
                    x <= ( a & ~b & ~c & ~d) |
                         ( a &       c &  d) |
                         (~a &  b & ~c)      |
                         (~a &       c & ~d) |
                         (      b &  c & ~d);
 
                    y <= ( a & ~b &      ~d) |
                         ( a &       c & ~d) |
                         (~a &  b & ~c)      |
                         (~a &  b &       d) |
                         (~a &      ~c &  d) |
                         (      b & ~c &  d);
 
                    z <= ( a &  b &      ~d) |
                         ( a & ~b &  c)      |
                         (~a & ~b & ~c)      |
                         (~a &      ~c &  d) |
                         (      b &  c & ~d);
                 end
               /////////////////////////////////
    	       4'd3:
                 begin
                    w <= ( a & ~b)           | 
                         ( a &       c & ~d) |
                         (~a &  b &  c &  d) |
                         (~a &  b & ~c & ~d) |
                         (     ~b & ~c &  d);
 
                    x <= ( a &  b &  c)      |
                         ( a & ~b & ~c & ~d) |
                         (~a &  b & ~c)      |
                         (      b &  c & ~d) |
                         (~b &       c &  d);
 
                    y <= ( a &  b &       d) |
                         ( a & ~b & ~c & ~d) |
                         ( a &       c &  d) |
                         (~a &  b &  c)      |
                         (~a & ~b & ~c &  d) |
                         (~a &       c & ~d);
 
                    z <= ( a &  b &  c &  d) |
                         ( a & ~b &      ~d) |
                         (~a & ~b &       d) |
                         (      b & ~c & ~d) |
                         (     ~b &  c & ~d);
                 end
               /////////////////////////////////
    	       4'd4:
                 begin
                    w <= ( a & ~b & ~c)      | 
                         ( a &      ~c & ~d) | 
                         (~a &  b &  c)      |
                         (~a &       c &  d) | 
                         (      b &  c &  d) | 
                         (     ~b & ~c & ~d);
 
                    x <= ( a &  b & ~c)      |
                         ( a & ~b &  c &  d) |
                         ( a &      ~c & ~d) |
                         (~a &  b &  c)      |
                         (~a & ~b & ~c &  d) |
                         (      b &  c & ~d);
 
                    y <= ( a &  b &  c)      |
                         ( a & ~b & ~c)      |
                         ( a & ~b &       d) |
                         (~a &  b &       d) |
                         (~a & ~b &  c & ~d);
 
                    z <= a ^ (d & (a | b)) ^ (b | c);
                 end
               /////////////////////////////////
    	       4'd5:
                 begin
                    w <= ( a & ~b & ~c)      |
                         ( a &      ~c & ~d) |
                         (~a &  b &  c)      |
                         (~a &       c &  d) |
                         (      b &  c &  d) |
                         (~b &      ~c & ~d);
 
                    x <= ( a & ~b &  c)      |
                         ( a & ~b &       d) |
                         (~a &  b &       d) |
                         (~a &      ~c & ~d) |
                         (      b & ~c & ~d);
 
                    y <= ( a &  b &  c & ~d) |
                         (~a &  b &       d) |
                         (~a & ~b &  c)      |
                         (     ~b &  c &  d) |
                         (     ~b & ~c & ~d);
 
                    z <= ( a &  b & ~c)      |
                         ( a &       c & ~d) |
                         (~a & ~b &  c &  d) |
                         (~a & ~b & ~c & ~d) |
                         (      b &  c & ~d) |
                         (      b & ~c &  d);
                 end
               /////////////////////////////////
    	       4'd6:
                 begin
                    w <= ( a &  b &      ~d) |
                         ( a &      ~c &  d) |
                         (~a & ~b & ~c & ~d) |
                         (      b & ~c &  d) |
                         (     ~b &  c &  d);
 
                    x <= ~(b ^ c ^ (a & d));
 
                    y <= ( a &  b & ~c)      |
                         ( a & ~b &  c & ~d) |
                         (~a &  b &      ~d) |
                         (~a & ~b & ~c)      |
                         (~a & ~b &       d);
 
                    z <= ( a &  b &  c & ~d) |
                         ( a &      ~c &  d) |
                         (~a &  b & ~c & ~d) |
                         (~a & ~b &  c)      |
                         (~a &       c &  d) |
                         (     ~b & ~c &  d);
                 end
               /////////////////////////////////
    	       4'd7:
                 begin
                    w <= ( a &  b &  c & ~d) |
                         (~a & ~b & ~c)      |
                         (~a &       c &  d) |
                         (~a &      ~c & ~d) |
                         (     ~b &  c &  d) |
                         (     ~b & ~c & ~d);
 
                    x <= ( a &  b &  c)      |
                         ( a &  b &       d) |
                         ( a &       c &  d) |
                         (~a &  b &      ~d) |
                         (~a & ~b & ~c &  d) |
                         (~a &       c & ~d);
 
                    y <= ( a & ~b & ~c)      |
                         (~a &  b & ~c)      |
                         (~a & ~b &  c & ~d) |
                         (~a &      ~c &  d) |
                         (      b &  c &  d);
 
                    z <= c ^ (a & ~d) ^ (b | (a & c));
                 end
               /////////////////////////////////
             endcase // case (box_n)
          end
       end
endmodule

And a simple “smoke test”:

`timescale 1ns/100ps
 
`include "sbox.v"
 
 
module serpent_sbox_tester;
   reg clk = 0;
 
   // firing signal
   reg f = 0;
 
   // box #
   reg [3:0] box_n = 0;
 
   // inputs
   reg [31:0] a = 0;
   reg [31:0] b = 0;
   reg [31:0] c = 0;
   reg [31:0] d = 0;
 
   // outputs
   wire [31:0] w;
   wire [31:0] x;
   wire [31:0] y;
   wire [31:0] z;
 
   // serpent 'forward' sbox
   sbox_forward sbf(.clk(clk),
                    .fire(f),
                    .box_n(box_n),
                    .a(a), .b(b), .c(c), .d(d),
                    .w(w), .x(x), .y(y), .z(z));
 
   // clockator
   always
     begin
	clk = 1'b1;
	#1;
	clk = 1'b0;
	#1;
     end
 
   initial
     begin: Init
 
	#0 $display ("Started...\n");
 
        #0 a = 32'hDEADF00D;
        #0 b = 32'hC0DEDBAD;
        #0 c = 32'hCAFEBABE;
        #0 d = 32'hBADCAFED;
 
        // display inputs
        $display ("a = %h  b = %h  c = %h  d = %h", a, b, c, d);
        #1 f = 1;
 
        // sbox 0:
        #1 box_n = 0;
        $display ("box_n = %h", box_n);
        #2;
        $display ("w = %h  x = %h  y = %h  z = %h", w, x, y, z);
 
        // sbox 1:
        #3 box_n = 1;
        $display ("box_n = %h", box_n);
        #4;
        $display ("w = %h  x = %h  y = %h  z = %h", w, x, y, z);
 
        // sbox 2:
        #5 box_n = 2;
        $display ("box_n = %h", box_n);
        #6;
        $display ("w = %h  x = %h  y = %h  z = %h", w, x, y, z);
 
        // sbox 3:
        #7 box_n = 3;
        $display ("box_n = %h", box_n);
        #8;
        $display ("w = %h  x = %h  y = %h  z = %h", w, x, y, z);
 
        // sbox 4:
        #9 box_n = 4;
        $display ("box_n = %h", box_n);
        #10;
        $display ("w = %h  x = %h  y = %h  z = %h", w, x, y, z);
 
        // sbox 5:
        #11 box_n = 5;
        $display ("box_n = %h", box_n);
        #12;
        $display ("w = %h  x = %h  y = %h  z = %h", w, x, y, z);
 
        // sbox 6:
        #13 box_n = 6;
        $display ("box_n = %h", box_n);
        #14;
        $display ("w = %h  x = %h  y = %h  z = %h", w, x, y, z);
 
        // sbox 7:
        #15 box_n = 7;
        $display ("box_n = %h", box_n);
        #16;
        $display ("w = %h  x = %h  y = %h  z = %h", w, x, y, z);
 
        $display ("Finish.\n");
	$finish;
     end // block: Init
 
endmodule
# Project Name
PROJ=small
 
# Simulator testbench
BENCH=tester
 
sim:
	iverilog -v $(BENCH).v -o $(PROJ)sim
make
./smallsim

... produced the following output:

a = deadf00d  b = c0dedbad  c = cafebabe  d = badcafed
box_n = 0
w = 51525aa0  x = 61201453  y = b0ae854c  z = f4dd9efe
box_n = 1
w = 3b526ef2  x = 51505ba0  y = 8f8fe10c  z = 5f013113
box_n = 2
w = 7a507ef2  x = ce8fb11e  y = 64711fe1  z = 6b227540
box_n = 3
w = 7e713ee0  x = ce8fb10c  y = aedfaeff  z = a4adc45e
box_n = 4
w = 95dfcaac  x = 6e537ee1  y = deddbbbe  z = 8e8fa01f
box_n = 5
w = 95dfcaac  x = 1b706ba0  y = 4f513bb2  z = 41225101
box_n = 6
w = 5b007101  x = 6f533ee1  y = 21224441  z = 70501ef3
box_n = 7
w = 6f513ee0  x = ea8eb45f  y = b4dd8ffe  z = 44211113
Finish.

Let's quickly verify, using a section of the ancient C source for Serpent:

    #define u32 uint32_t
 
    #define SBOX0(a, b, c, d, w, x, y, z) \
    { \
    u32 t02, t03, t05, t06, t07, t08, t09; \
    u32 t11, t12, t13, t14, t15, t17, t01; \
    t01 = b   ^ c  ; \
    t02 = a   | d  ; \
    t03 = a   ^ b  ; \
    z   = t02 ^ t01; \
    t05 = c   | z  ; \
    t06 = a   ^ d  ; \
    t07 = b   | c  ; \
    t08 = d   & t05; \
    t09 = t03 & t07; \
    y   = t09 ^ t08; \
    t11 = t09 & y  ; \
    t12 = c   ^ d  ; \
    t13 = t07 ^ t11; \
    t14 = b   & t06; \
    t15 = t06 ^ t13; \
    w   =     ~ t15; \
    t17 = w   ^ t14; \
    x   = t12 ^ t17; \
    }
 
    #define SBOX1(a, b, c, d, w, x, y, z) \
    { \
    u32 t02, t03, t04, t05, t06, t07, t08; \
    u32 t10, t11, t12, t13, t16, t17, t01; \
    t01 = a   | d  ; \
    t02 = c   ^ d  ; \
    t03 =     ~ b  ; \
    t04 = a   ^ c  ; \
    t05 = a   | t03; \
    t06 = d   & t04; \
    t07 = t01 & t02; \
    t08 = b   | t06; \
    y   = t02 ^ t05; \
    t10 = t07 ^ t08; \
    t11 = t01 ^ t10; \
    t12 = y   ^ t11; \
    t13 = b   & d  ; \
    z   =     ~ t10; \
    x   = t13 ^ t12; \
    t16 = t10 | x  ; \
    t17 = t05 & t16; \
    w   = c   ^ t17; \
    }
 
    #define SBOX2(a, b, c, d, w, x, y, z) \
    { \
    u32 t02, t03, t05, t06, t07, t08; \
    u32 t09, t10, t12, t13, t14, t01; \
    t01 = a   | c  ; \
    t02 = a   ^ b  ; \
    t03 = d   ^ t01; \
    w   = t02 ^ t03; \
    t05 = c   ^ w  ; \
    t06 = b   ^ t05; \
    t07 = b   | t05; \
    t08 = t01 & t06; \
    t09 = t03 ^ t07; \
    t10 = t02 | t09; \
    x   = t10 ^ t08; \
    t12 = a   | d  ; \
    t13 = t09 ^ x  ; \
    t14 = b   ^ t13; \
    z   =     ~ t09; \
    y   = t12 ^ t14; \
    }
 
    #define SBOX3(a, b, c, d, w, x, y, z) \
    { \
    u32 t02, t03, t04, t05, t06, t07, t08; \
    u32 t09, t10, t11, t13, t14, t15, t01; \
    t01 = a   ^ c  ; \
    t02 = a   | d  ; \
    t03 = a   & d  ; \
    t04 = t01 & t02; \
    t05 = b   | t03; \
    t06 = a   & b  ; \
    t07 = d   ^ t04; \
    t08 = c   | t06; \
    t09 = b   ^ t07; \
    t10 = d   & t05; \
    t11 = t02 ^ t10; \
    z   = t08 ^ t09; \
    t13 = d   | z  ; \
    t14 = a   | t07; \
    t15 = b   & t13; \
    y   = t08 ^ t11; \
    w   = t14 ^ t15; \
    x   = t05 ^ t04; \
    }
 
    #define SBOX4(a, b, c, d, w, x, y, z) \
    { \
    u32 t02, t03, t04, t05, t06, t08, t09; \
    u32 t10, t11, t12, t13, t14, t15, t16, t01; \
    t01 = a   | b  ; \
    t02 = b   | c  ; \
    t03 = a   ^ t02; \
    t04 = b   ^ d  ; \
    t05 = d   | t03; \
    t06 = d   & t01; \
    z   = t03 ^ t06; \
    t08 = z   & t04; \
    t09 = t04 & t05; \
    t10 = c   ^ t06; \
    t11 = b   & c  ; \
    t12 = t04 ^ t08; \
    t13 = t11 | t03; \
    t14 = t10 ^ t09; \
    t15 = a   & t05; \
    t16 = t11 | t12; \
    y   = t13 ^ t08; \
    x   = t15 ^ t16; \
    w   =     ~ t14; \
    }
 
    #define SBOX5(a, b, c, d, w, x, y, z) \
    { \
    u32 t02, t03, t04, t05, t07, t08, t09; \
    u32 t10, t11, t12, t13, t14, t01; \
    t01 = b   ^ d  ; \
    t02 = b   | d  ; \
    t03 = a   & t01; \
    t04 = c   ^ t02; \
    t05 = t03 ^ t04; \
    w   =     ~ t05; \
    t07 = a   ^ t01; \
    t08 = d   | w  ; \
    t09 = b   | t05; \
    t10 = d   ^ t08; \
    t11 = b   | t07; \
    t12 = t03 | w  ; \
    t13 = t07 | t10; \
    t14 = t01 ^ t11; \
    y   = t09 ^ t13; \
    x   = t07 ^ t08; \
    z   = t12 ^ t14; \
    }
 
    #define SBOX6(a, b, c, d, w, x, y, z) \
    { \
    u32 t02, t03, t04, t05, t07, t08, t09, t10; \
    u32 t11, t12, t13, t15, t17, t18, t01; \
    t01 = a   & d  ; \
    t02 = b   ^ c  ; \
    t03 = a   ^ d  ; \
    t04 = t01 ^ t02; \
    t05 = b   | c  ; \
    x   =     ~ t04; \
    t07 = t03 & t05; \
    t08 = b   & x  ; \
    t09 = a   | c  ; \
    t10 = t07 ^ t08; \
    t11 = b   | d  ; \
    t12 = c   ^ t11; \
    t13 = t09 ^ t10; \
    y   =     ~ t13; \
    t15 = x   & t03; \
    z   = t12 ^ t07; \
    t17 = a   ^ b  ; \
    t18 = y   ^ t15; \
    w   = t17 ^ t18; \
    }
 
    #define SBOX7(a, b, c, d, w, x, y, z) \
    { \
    u32 t02, t03, t04, t05, t06, t08, t09, t10; \
    u32 t11, t13, t14, t15, t16, t17, t01; \
    t01 = a   & c  ; \
    t02 =     ~ d  ; \
    t03 = a   & t02; \
    t04 = b   | t01; \
    t05 = a   & b  ; \
    t06 = c   ^ t04; \
    z   = t03 ^ t06; \
    t08 = c   | z  ; \
    t09 = d   | t05; \
    t10 = a   ^ t08; \
    t11 = t04 & z  ; \
    x   = t09 ^ t10; \
    t13 = b   ^ x  ; \
    t14 = t01 ^ x  ; \
    t15 = c   ^ t05; \
    t16 = t11 | t13; \
    t17 = t02 | t14; \
    w   = t15 ^ t17; \
    y   = a   ^ t16; \
    }
 
    uint32_t a = 0xDEADF00D;
    uint32_t b = 0xC0DEDBAD;
    uint32_t c = 0xCAFEBABE;
    uint32_t d = 0xBADCAFED;
 
    uint32_t w = 0, x = 0, y = 0, z = 0;
 
    void clear() {
    w = 0;
    x = 0;
    y = 0;
    z = 0;
    }
 
    void dump_ins() {
    printf("a = 0x%08x  b = 0x%08x  c = 0x%08x  d = 0x%08x\n", a, b, c, d);
    }
 
    void dump_outs() {
    printf("w = 0x%08x  x = 0x%08x  y = 0x%08x  z = 0x%08x\n", w, x, y, z);
    }
 
 
    void main() {
 
    dump_ins();
 
    printf("SBOX0:\n");
    clear();
    SBOX0(a, b, c, d, w, x, y, z);
    dump_outs();
 
    printf("SBOX1:\n");
    clear();
    SBOX1(a, b, c, d, w, x, y, z);
    dump_outs();
 
    printf("SBOX2:\n");
    clear();
    SBOX2(a, b, c, d, w, x, y, z);
    dump_outs();
 
    printf("SBOX3:\n");
    clear();
    SBOX3(a, b, c, d, w, x, y, z);
    dump_outs();
 
    printf("SBOX4:\n");
    clear();
    SBOX4(a, b, c, d, w, x, y, z);
    dump_outs();
 
    printf("SBOX5:\n");
    clear();
    SBOX5(a, b, c, d, w, x, y, z);
    dump_outs();
 
    printf("SBOX6:\n");
    clear();
    SBOX6(a, b, c, d, w, x, y, z);
    dump_outs();
 
    printf("SBOX7:\n");
    clear();
    SBOX7(a, b, c, d, w, x, y, z);
    dump_outs();
 
    }

The latter spits out:

a = 0xdeadf00d  b = 0xc0dedbad  c = 0xcafebabe  d = 0xbadcafed
SBOX0:
w = 0x51525aa0  x = 0x61201453  y = 0xb0ae854c  z = 0xf4dd9efe
SBOX1:
w = 0x3b526ef2  x = 0x51505ba0  y = 0x8f8fe10c  z = 0x5f013113
SBOX2:
w = 0x7a507ef2  x = 0xce8fb11e  y = 0x64711fe1  z = 0x6b227540
SBOX3:
w = 0x7e713ee0  x = 0xce8fb10c  y = 0xaedfaeff  z = 0xa4adc45e
SBOX4:
w = 0x95dfcaac  x = 0x6e537ee1  y = 0xdeddbbbe  z = 0x8e8fa01f
SBOX5:
w = 0x95dfcaac  x = 0x1b706ba0  y = 0x4f513bb2  z = 0x41225101
SBOX6:
w = 0x5b007101  x = 0x6f533ee1  y = 0x21224441  z = 0x70501ef3
SBOX7:
w = 0x6f513ee0  x = 0xea8eb45f  y = 0xb4dd8ffe  z = 0x44211113

I.e. a matching set, for the particular input.

Not a proof of correctness, by any means, but we do learn that there is no obvious mistake.

The next logical step of the experiment would be to put the forward S-box component into an ICE40 and see precisely how many gates it occupies. Then can multiply this by two (there is also an inverse S-Box, and see whether it makes sense to attempt to produce the rest of the mechanism. The 32kB of block RAM available on the largest ICE40, theoretically suffices for Serpent's key schedule and other required buffers. But does the gate count?

~To be continued!~