## “Finite Field Arithmetic.” Chapter 12A: Karatsuba Redux. (Part 1 of 2)

This article is part of a series of hands-on tutorials introducing FFA, or the Finite Field Arithmetic library. FFA differs from the typical “Open Sores” abomination, in that — rather than trusting the author blindly with their lives — prospective users are expected to read and fully understand every single line. In exactly the same manner that you would understand and pack your own parachute. The reader will assemble and test a working FFA with his own hands, and at the same time grasp the purpose of each moving part therein.

You will need:

• A Keccak-based VTron (for this and all subsequent chapters.)
• All of the materials from Chapters 1 – 11. (They have been re-ground for the new VTron format; please re-download here.)
• There is no vpatch in Chapter 12A.

On account of the substantial heft of this chapter, I have cut it into two parts, 12A and 12B; you are presently reading 12A, which consists strictly of the benchmarks and detailed analysis of the Karatsuba method presented earlier. 12B will appear here in the course of the next several days, preceding Ch. 13.

First things first:

As noted earlier in Chapter 11:

And so I have carried out a benchmark battery strictly on Multiplication — naturally, on the standard test machine used for all previous benchmarks — across a meaningful range of FFA bitnesses (i.e. integers large enough not to fall through the resolution of the timer), across all of the multiplier routine variants offered in chapters 9 – 11:

Or, for those who prefer the raw numbers to the logarithmic plot,

Cost of 1000 Multiplication Operations (sec):
FFA Bitness Ch.9 “Soft” Comba Ch.9 “Iron” Comba Ch.10 Karatsuba (on Iron Comba) Ch.11 Karatsuba (on Iron Comba) with Inlining
2048 0.120 0.019 0.015 0.012
4096 0.480 0.074 0.046 0.035
8192 1.911 0.295 0.140 0.106
16384 7.638 1.170 0.427 0.328

The first item to discuss is that the introduction of ave1’s new Musl GNAT had no measurable effect on the performance of the compiled FFA code.

Therefore the above benchmark does not list separate measurements for the new and old GNATs, as they turned out to build executables which perform identically within the margin of error given by the timer resolution.

This is not a particularly surprising discovery, given as the new GNAT is largely the same as the GNAT I had been using previously, but for the fact that it builds on Musl rather than rotten old glibc. Given as FFA spends no substantial time in libc, this observation is not astonishing.

At the same time I will note that all subsequent FFA tests will be carried out on the new GNAT, and the reader is advised to build himself a working copy.

However, ave1’s inlining fix does have a measurable effect on performance: this is reflected in the smaller number of CPU cycles eaten by the FFA of Ch.11 compared to that of Ch.10.

The next item to discuss is the fact that the use of Mul_HalfWord_Soft in Word x Word multiplication imposes a substantial performance penalty.

Reader apeloyee was indeed correct: the slowdown was obscured in the modular exponentiation benchmark of Chapter 9 by the predominance of the modular reduction’s cost over that of multiplication’s. (This will be discussed in detail in Ch. 12B.)

On machines having a constant-time MUL instruction (e.g. AMD64) the use of “soft” Word x Word base case multiplication is an unnecessary sacrifice, and therefore the proclamation given in Chapter 9 is hereby withdrawn: people stuck with broken CPU architectures will be responsible for enabling the necessary workaround with their own hands, rather than imposing its cost on all FFA users.

At the conclusion of the FFA series, we will discuss a clean (i.e. via V-branches) means of offering the use of “soft” Word x Word multiplication on machines which require it, as well as a simple litmus test for the presence of a broken (i.e. one having a non-constant-time iron multiplier) CPU. But until then, all subsequent FFA benchmarks published here will presume the use of “Iron” Word x Word multiplication.

The last, and by far least surprising, observation concerning the benchmark is that Karatsuba multiplication is indeed faster (the exact runtime complexity of it — I will leave as an exercise for the reader) for sufficiently large integers, than the Ch. 9 O(N^2) Comba method (the latter remains in use, however, as the base case of Karatsuba.)

At this time we will walk through the mechanics of our Karatsuba multiplier, so as to cement in the reader’s head the correctness of the routine, and lay groundwork for the optimization which is introduced in Ch. 12B.

Let’s revisit the Karatsuba routine, as given in Chapter 11:

``` -- ...   -- Karatsuba's Multiplier. (CAUTION: UNBUFFERED) procedure Mul_Karatsuba(X : in FZ; Y : in FZ; XY : out FZ) is   -- L is the wordness of a multiplicand. Guaranteed to be a power of two. L : constant Word_Count := X'Length;   -- An 'LSeg' is the same length as either multiplicand. subtype LSeg is FZ(1 .. L);   -- K is HALF of the length of a multiplicand. K : constant Word_Index := L / 2;   -- A 'KSeg' is the same length as HALF of a multiplicand. subtype KSeg is FZ(1 .. K);   -- The three L-sized variables of the product equation, i.e.: -- XY = LL + 2^(K*Bitness)(LL + HH + (-1^DD_Sub)*DD) + 2^(2*K*Bitness)HH LL, DD, HH : LSeg;   -- K-sized terms of Dx * Dy = DD Dx, Dy : KSeg; -- Dx = abs(XLo - XHi) , Dy = abs(YLo - YHi)   -- Subtraction borrows, signs of (XL - XH) and (YL - YH), Cx, Cy : WBool; -- so that we can calculate (-1^DD_Sub)   -- Bottom and Top K-sized halves of the multiplicand X. XLo : KSeg renames X( X'First .. X'Last - K ); XHi : KSeg renames X( X'First + K .. X'Last );   -- Bottom and Top K-sized halves of the multiplicand Y. YLo : KSeg renames Y( Y'First .. Y'Last - K ); YHi : KSeg renames Y( Y'First + K .. Y'Last );   -- L-sized middle segment of the product XY (+/- K from the midpoint). XYMid : LSeg renames XY( XY'First + K .. XY'Last - K );   -- Bottom and Top L-sized halves of the product XY. XYLo : LSeg renames XY( XY'First .. XY'Last - L ); XYHi : LSeg renames XY( XY'First + L .. XY'Last );   -- Topmost K-sized quarter segment of the product XY, or 'tail' XYHiHi : KSeg renames XYHi( XYHi'First + K .. XYHi'Last );   -- Whether the DD term is being subtracted. DD_Sub : WBool;   -- Carry from individual term additions. C : WBool;   -- Tail-Carry accumulator, for the final ripple TC : Word;   begin   -- Recurse: LL := XL * YL FZ_Multiply_Unbuffered(XLo, YLo, LL);   -- Recurse: HH := XH * YH FZ_Multiply_Unbuffered(XHi, YHi, HH);   -- Dx := |XL - XH| , Cx := Borrow (i.e. 1 iff XL < XH) FZ_Sub_Abs(X => XLo, Y => XHi, Difference => Dx, Underflow => Cx);   -- Dy := |YL - YH| , Cy := Borrow (i.e. 1 iff YL < YH) FZ_Sub_Abs(X => YLo, Y => YHi, Difference => Dy, Underflow => Cy);   -- Recurse: DD := Dx * Dy FZ_Multiply_Unbuffered(Dx, Dy, DD);   -- Whether (XL - XH)(YL - YH) is positive, and so DD must be subtracted: DD_Sub := 1 - (Cx xor Cy);   -- XY := LL + 2^(2 * K * Bitness) * HH XYLo := LL; XYHi := HH;   -- XY += 2^(K * Bitness) * HH, but carry goes in Tail Carry accum. FZ_Add_D(X => XYMid, Y => HH, Overflow => TC);   -- XY += 2^(K * Bitness) * LL, ... FZ_Add_D(X => XYMid, Y => LL, Overflow => C);   -- ... but the carry goes into the Tail Carry accumulator. TC := TC + C;   -- XY += 2^(K * Bitness) * (-1^DD_Sub) * DD FZ_Not_Cond_D(N => DD, Cond => DD_Sub); -- invert DD if 2s-complementing FZ_Add_D(OF_In => DD_Sub, -- ... and then must increment X => XYMid, Y => DD, Overflow => C); -- carry will go in Tail Carry accumulator   -- Compute the final Tail Carry for the ripple TC := TC + C - DD_Sub;   -- Barring a cosmic ray, 0 < = TC <= 2 . pragma Assert(TC <= 2);   -- Ripple the Tail Carry into the tail. FZ_Add_D_W(X => XYHiHi, W => TC, Overflow => C);   -- Barring a cosmic ray, the tail ripple will NOT overflow. pragma Assert(C = 0);   end Mul_Karatsuba; -- CAUTION: Inlining prohibited for Mul_Karatsuba !     -- Multiplier. (CAUTION: UNBUFFERED) procedure FZ_Multiply_Unbuffered(X : in FZ; Y : in FZ; XY : out FZ) is   -- The length of either multiplicand L : constant Word_Count := X'Length;   begin   if L < = Karatsuba_Thresh then   -- Base case: FZ_Mul_Comba(X, Y, XY);   else   -- Recursive case: Mul_Karatsuba(X, Y, XY);   end if;   end FZ_Multiply_Unbuffered;```

And now let’s step through the whole thing, in light of the arithmetical overview given in Chapter 10.

Recall that we derived the following equivalences for Karatsuba’s method:

LL = XLoYLo
HH = XHiYHi

Dx = |XLo - XHi|
Dy = |YLo - YHi|

DD = Dx × Dy

DDSub = CX XNOR CY

XY = LL + 2b(LL + HH + (-1DDSub)DD) + 22bHH

… where XLo and XHi are the bottom and top halves of the multiplicand X, respectively; YLo and YHi — of multiplicand Y; CX is the subtraction “borrow” resulting from the computation of Dx; and CY is same from the computation of Dy.

… and showed that the operation can be represented in the following “physical” form (junior bits of registers on left hand side, senior — on right hand) :

 LL HH TC := 0 + LL TC += Carry + HH TC += Carry + (-1DDSub)DD TC += Carry – DDSub + TC = XY

Now let’s go through the routine itself and see which moving parts of the Ada program correspond to which pieces of the equivalence. And so, we begin at the beginning:

``` -- Karatsuba's Multiplier. (CAUTION: UNBUFFERED) procedure Mul_Karatsuba(X : in FZ; Y : in FZ; XY : out FZ) is```

X and Y, naturally, are the multiplicands; XY is the register to which the result of the multiplication is to be written. Observe that in the procedure's declaration:

``` -- ... -- Karatsuba's Multiplier. (CAUTION: UNBUFFERED) procedure Mul_Karatsuba(X : in FZ; Y : in FZ; XY : out FZ) with Pre => X'Length = Y'Length and XY'Length = (X'Length + Y'Length) and X'Length mod 2 = 0; -- CAUTION: Inlining prohibited for Mul_Karatsuba !```

... it is mandated that the length of XY must suffice to hold the resulting integer; and that the length of each multiplicand must be divisible by two. (Recall that valid FZ integers must in fact be of lengths which constitute powers of 2; the reason for this will become evident shortly.)

We have thereby obtained the "physical" representation shown earlier in Ch. 10:

 XLo XHi × YLo YHi = XY

Let's proceed:

``` -- L is the wordness of a multiplicand. Guaranteed to be a power of two. L : constant Word_Count := X'Length;   -- An 'LSeg' is the same length as either multiplicand. subtype LSeg is FZ(1 .. L);```

L is simply the length of either multiplicand (they are required, as shown in the declaration, to be of equal lengths.) K then corresponds to half of the length of a multiplicand; by breaking apart the multiplicands we will achieve the "divide and conquer" effect of Karatsuba's method, whereby we convert one multiplication of size 2K x 2K into three multiplications of size K x K.

Thereby L is the bit width of the

 XLo XHi

... and

 YLo YHi

... multiplicand registers; and as for K:

``` -- K is HALF of the length of a multiplicand. K : constant Word_Index := L / 2;   -- A 'KSeg' is the same length as HALF of a multiplicand. subtype KSeg is FZ(1 .. K);```

K is the bit width of the low and high halves of the multiplicand registers, i.e. XLo, XHi, YLo, and YHi. Now we define the working registers for the intermediate terms in the equation:

``` -- The three L-sized variables of the product equation, i.e.: -- XY = LL + 2^(K*Bitness)(LL + HH + (-1^DD_Sub)*DD) + 2^(2*K*Bitness)HH LL, DD, HH : LSeg;   -- K-sized terms of Dx * Dy = DD Dx, Dy : KSeg; -- Dx = abs(XLo - XHi) , Dy = abs(YLo - YHi)```

... let's also "draw to scale" all of these registers, and describe their desired eventual contents, referring to the earlier equivalences:

LL = XLoYLo

 XLo x YLo LL

HH = XHiYHi

 XHi x YHi HH

Dx = |XLo - XHi|

 XLo |-| XHi = Dx

Dy = |YLo - YHi|

 YLo |-| YHi = Dy

DD = Dx × Dy

 Dx x Dy = DD

Observe that DD is of width L, as FFA multiplication always results in an output having the summed width of the two multiplicands.

Now for Cx and Cy:

``` -- Subtraction borrows, signs of (XL - XH) and (YL - YH), Cx, Cy : WBool; -- so that we can calculate (-1^DD_Sub)```

These are simply the borrows recorded from the computation of Dx and Dy, we will need them when computing DD_Sub later on. Moving on:

``` -- Bottom and Top K-sized halves of the multiplicand X. XLo : KSeg renames X( X'First .. X'Last - K ); XHi : KSeg renames X( X'First + K .. X'Last );   -- Bottom and Top K-sized halves of the multiplicand Y. YLo : KSeg renames Y( Y'First .. Y'Last - K ); YHi : KSeg renames Y( Y'First + K .. Y'Last );```

We already described these, they are the upper and lower halves of X and Y, i.e. the multiplicands.

Now, the middle term, XYMid:

``` -- L-sized middle segment of the product XY (+/- K from the midpoint). XYMid : LSeg renames XY( XY'First + K .. XY'Last - K );```

XYMid is where we will be putting... (ignore TC for now...)

 + LL TC += Carry + HH TC += Carry + (-1DDSub)DD TC += Carry - DDSub

... i.e. the "middle" terms. It represents a "slice" of the multiplication's output register XY. But in order to represent the first term of the equivalence,

 LL HH TC := 0

... we will also need to represent top and bottom "slices" of the output XY:

``` -- Bottom and Top L-sized halves of the product XY. XYLo : LSeg renames XY( XY'First .. XY'Last - L ); XYHi : LSeg renames XY( XY'First + L .. XY'Last );```

Lastly, we will require a K-sized "slice" representation of XY, where we will be rippling out the accumulated "tail" carry, TC:

``` -- Topmost K-sized quarter segment of the product XY, or 'tail' XYHiHi : KSeg renames XYHi( XYHi'First + K .. XYHi'Last );```
 + TC = XY

... when we complete the computation of the product XY.

As for:

``` -- Whether the DD term is being subtracted. DD_Sub : WBool;   -- Carry from individual term additions. C : WBool;   -- Tail-Carry accumulator, for the final ripple TC : Word;```

... we have already described them above, so let's:

` begin`

And compute term LL:

``` -- Recurse: LL := XL * YL FZ_Multiply_Unbuffered(XLo, YLo, LL);```

LL = XLoYLo

 XLo x YLo LL

... and then term HH:

``` -- Recurse: HH := XH * YH FZ_Multiply_Unbuffered(XHi, YHi, HH);```

HH = XHiYHi

 XHi x YHi HH

Observe that we have begun to recurse: the invocations of multiplication may result in another Karatsubaization, or alternatively in an invocation of the Comba base case, depending on whether Karatsuba_Thresh is crossed; as specified in:

``` -- Multiplier. (CAUTION: UNBUFFERED) procedure FZ_Multiply_Unbuffered(X : in FZ; Y : in FZ; XY : out FZ) is   -- The length of either multiplicand L : constant Word_Count := X'Length;   begin   if L < = Karatsuba_Thresh then   -- Base case: FZ_Mul_Comba(X, Y, XY);   else   -- Recursive case: Mul_Karatsuba(X, Y, XY);   end if;   end FZ_Multiply_Unbuffered;```

The constant for the base case transition was determined empirically, and its optimal value appears to be the same on all machine architectures. However, the reader is invited to carry out his own experiments.

We have performed out two of our three recursions; we now want Dx:

Dx = |XLo - XHi|

 XLo |-| XHi = Dx
``` -- Dx := |XL - XH| , Cx := Borrow (i.e. 1 iff XL < XH) FZ_Sub_Abs(X => XLo, Y => XHi, Difference => Dx, Underflow => Cx);```

... and Dy:

Dy = |YLo - YHi|

 YLo |-| YHi = Dy
``` -- Dy := |YL - YH| , Cy := Borrow (i.e. 1 iff YL < YH) FZ_Sub_Abs(X => YLo, Y => YHi, Difference => Dy, Underflow => Cy);```

It is now time to show how FZ_Sub_Abs works:

``` -- Destructive: If Cond is 1, NotN := ~N; otherwise NotN := N. procedure FZ_Not_Cond_D(N : in out FZ; Cond : in WBool)is   -- The inversion mask Inv : constant Word := 0 - Cond;   begin   for i in N'Range loop   -- Invert (or, if Cond is 0, do nothing) N(i) := N(i) xor Inv;   end loop;   end FZ_Not_Cond_D;     -- Subtractor that gets absolute value if underflowed, in const. time procedure FZ_Sub_Abs(X : in FZ; Y : in FZ; Difference : out FZ; Underflow : out WBool) is   O : Word := 0; pragma Unreferenced(O);   begin   -- First, we subtract normally FZ_Sub(X, Y, Difference, Underflow);   -- If borrow - negate, FZ_Not_Cond_D(Difference, Underflow);   -- ... and also increment. FZ_Add_D_W(Difference, Underflow, O);   end FZ_Sub_Abs;```

FZ_Sub_Abs is simply a constant-time means of taking the absolute value of a subtraction, and saving the output along with any resulting "borrow" bit for possible later use. Take careful note of the FZ_Not_Cond_D mechanism, you will be seeing it again shortly. The "D" stands for "Destructive" -- by this convention we refer to internal routines in FFA which operate "in-place", directly modifying their operand.

Moving on, we now want DD:

DD = Dx × Dy

 Dx x Dy = DD
``` -- Recurse: DD := Dx * Dy FZ_Multiply_Unbuffered(Dx, Dy, DD);```

And we got it -- with our third and final recursive call. Now we want DD_Sub:

``` -- Whether (XL - XH)(YL - YH) is positive, and so DD must be subtracted: DD_Sub := 1 - (Cx xor Cy);```

Why this is a valid equation for DD_Sub, is shown in a lemma in Chapter 10; please refer to it if memory fails you. Moving on to the upper and lower XY subterms,

 LL HH TC := 0
``` -- XY := LL + 2^(2 * K * Bitness) * HH XYLo := LL; XYHi := HH;```

... and now let's begin to compute the middle term, XYMid:

 + LL TC += Carry + HH TC += Carry
``` -- XY += 2^(K * Bitness) * HH, but carry goes in Tail Carry accum. FZ_Add_D(X => XYMid, Y => HH, Overflow => TC);   -- XY += 2^(K * Bitness) * LL, ... FZ_Add_D(X => XYMid, Y => LL, Overflow => C);   -- ... but the carry goes into the Tail Carry accumulator. TC := TC + C;```

Observe that we accumulate the additions' carries in TC. But that's not all for the middle term, we also need the third subterm of it:

 + (-1DDSub)DD TC += Carry - DDSub

And we get it like this:

``` -- XY += 2^(K * Bitness) * (-1^DD_Sub) * DD FZ_Not_Cond_D(N => DD, Cond => DD_Sub); -- invert DD if 2s-complementing FZ_Add_D(OF_In => DD_Sub, -- ... and then must increment X => XYMid, Y => DD, Overflow => C); -- carry will go in Tail Carry accumulator```

We have already described FZ_Not_Cond_D; now it is necessary to review FZ_Add_D:

``` -- Destructive Add: X := X + Y; Overflow := Carry; optional OF_In procedure FZ_Add_D(X : in out FZ; Y : in FZ; Overflow : out WBool; OF_In : in WBool := 0) is Carry : WBool := OF_In; begin for i in 0 .. Word_Index(X'Length - 1) loop declare A : constant Word := X(X'First + i); B : constant Word := Y(Y'First + i); S : constant Word := A + B + Carry; begin X(X'First + i) := S; Carry := W_Carry(A, B, S); end; end loop; Overflow := Carry; end FZ_Add_D;```

This is simply "in-place" addition, economizing on stack space and CPU cycles by avoiding the use of an intermediate scratch register. Note that the mechanism is entirely agnostic of the particular element enumeration of the operand arrays -- this is required because we are operating on array slices, on which Ada wisely preserves the parent array's indexing.

Now we will compute the final "tail carry", TC, and ripple it into the final output of the multiplication, XY:

 + TC = XY
``` -- Compute the final Tail Carry for the ripple TC := TC + C - DD_Sub;   -- Barring a cosmic ray, 0 < = TC <= 2 . pragma Assert(TC <= 2);   -- Ripple the Tail Carry into the tail. FZ_Add_D_W(X => XYHiHi, W => TC, Overflow => C);   -- Barring a cosmic ray, the tail ripple will NOT overflow. pragma Assert(C = 0);```

The proof regarding the validity of the ripple equation is given in Chapter 10, the reader is again asked to review it if the correctness of the given mechanism is not obvious to him.

Observe that we take a "belt and suspenders" approach regarding the correct operation of the carry ripple mechanism. Conceivably the asserts may be omitted in a speed-critical application; but their cost appears to be too small to measure on my system, and so they are to remain in the canonical version of FFA.

And, lastly,

``` end Mul_Karatsuba; -- CAUTION: Inlining prohibited for Mul_Karatsuba !```

... naturally it is not permissible to inline a Karatsuba invocation, as the procedure is recursive.

We have now obtained the entire "sandwich" from earlier:

 LL HH TC := 0 + LL TC += Carry + HH TC += Carry + (-1DDSub)DD TC += Carry - DDSub + TC = XY

... i.e. the 2L-sized product XY of the L-sized multiplicands X and Y, having done so via three half-L-sized multiplications and a number of inexpensive additions/subtractions.

Satisfy yourself that at no point does the program branch on any bit inside the operands X and Y (i.e. it operates in constant time), and that the required stack memory and the depth of the recursion depend strictly on the FFA bitness set during invocation of FFACalc.

In Chapter 12B, we will examine an important special case of Karatsuba that merits a separate routine: squaring. Theoretically this operation requires only half of the CPU cycles demanded by the general case; and as it is made heavy use of in modular exponentiation:

``` -- Modular Exponent: Result := Base^Exponent mod Modulus procedure FZ_Mod_Exp(Base : in FZ; Exponent : in FZ; Modulus : in FZ; Result : out FZ) is   -- Working register for the squaring; initially is copy of Base B : FZ(Base'Range) := Base;   -- Copy of Exponent, for cycling through its bits E : FZ(Exponent'Range) := Exponent;   -- Register for the Mux operation T : FZ(Result'Range);   -- Buffer register for the Result R : FZ(Result'Range);   begin -- Result := 1 WBool_To_FZ(1, R);   -- For each bit of R width: for i in 1 .. FZ_Bitness(R) loop   -- T := Result * B mod Modulus FZ_Mod_Mul(X => R, Y => B, Modulus => Modulus, Product => T);   -- Sel is the current low bit of E; -- When Sel=0 -> Result := Result; -- When Sel=1 -> Result := T FZ_Mux(X => R, Y => T, Result => R, Sel => FZ_OddP(E));   -- Advance to the next bit of E FZ_ShiftRight(E, E, 1);   -- B := B*B mod Modulus FZ_Mod_Mul(X => B, Y => B, Modulus => Modulus, Product => B);   end loop;   -- Output the Result: Result := R;   end FZ_Mod_Exp;   end FZ_ModEx;```

... we will find that the squaring-case of Karatsuba merits inclusion in FFA.

We will also make use of a simple means of profiling the execution of the FFA routines -- one that is unique in its simplicity, while generally inapplicable to heathen cryptographic libraries on account of their failure to avoid branching on operand bits.

~To be continued!~

## “Finite Field Arithmetic” Regrind into Keccak-V Format.

The long-promised Keccak-V regrind of the current FFA codebase appears below:

These, and all subsequent chapter releases, can be pressed with e.g. Diana Coman’s VTron (and, I expect, various others.)
You can download a convenient tarball with all of the above items, here (signature here.)

To the folks who made this possible : thanks!

## “Finite Field Arithmetic” Projected Release Timeline.

Several of my readers recently let me know (privately and in the Forum) that they are ready to pioneer the battlefield use of FFA. However they all have one question, “When the hell will be the beta release? And just how much spade work remains, and where?”

And so I have written this projection, to summarize the articles remaining to write (some of these are already written, and require revision to conform to the corrections introduced in the code earlier; others must still be written, and the corresponding program routines cleaned up, tested, and properly illuminated; hence the variation in the estimated periods required for each component.)

So, without further delay:

No. Chapter Title (Tentative) Target Pub. Date
12 Keccak-V Regrind and Karatsuba In-Depth. Nov. 18, 2018
13 Constant-Time “Shift” and “Rotate”. Nov. 25, 2018
14 Fast Modular Reduction. Dec. 9, 2018
15 Bounded Loops in FFACalc. Dec. 16, 2018
16 Generation of Cryptographic Primes. Dec. 30, 2018
17 Introducing: “P” System. Jan. 6, 2019
18 Practical Key Generation in “P”. Jan. 13, 2019
19 RSA with OAEP; Signature, Encryption, Decryption. Jan. 27, 2019
20 Practical GPG Migration. Feb. 3, 2019
21 Optional: ASM Subroutines for AMD-64. Feb. 10, 2019
22 Misc. Stylistic Massage and Beta Release! Feb. 17, 2019

I reserve the right to run “ahead” of this calendar, if time permits. But if at any point a target date cannot be met, I will post a revised timeline, along with discussion of any pertinent obstacle.

Posted in: FFA, Friends, Progress by Stanislav 1 Comment

## Hypertext Concordance for “Finite Field Arithmetic.”

In addition to phf’s excellent vpatch viewer, there will now be a page, generated via gnathtml, to help the interested reader to explore the moving parts of FFA.

All subsequent chapters will also be offered in this reader-friendly format, in addition to the usual raw vpatch and text discussion. (If anyone wants to see the earlier chapters in this form, please let me know.)

## The Serpent Cipher’s Key Schedule Transform is Injective.

Let’s try this somewhat different variant of the program, which represents recurring bits of the expansion symbolically (and in a slightly more readable form) :

```;; Register bitness. (defconstant +bitness+ 32)   (defun make-reg (reg-name bitness) "Make algebraic representation of a register (bits in descending majority)" (loop for i from (1- bitness) downto 0 collect (make-symbol (format nil "~A~A" reg-name i))))   (defun integer-to-reg (n &optional (pad-width +bitness+)) "Generate algebraic represenation of the given integer n." (let* ((bits '()) (integer-bitness (integer-length n)) (pad-bitness (- pad-width integer-bitness))) (dotimes (index integer-bitness bits) (push (if (logbitp index n) 1 0) bits)) ;; Append padding zeros, if required to make full width: (loop repeat pad-bitness do (push 0 bits)) bits))   (defun RL11 (reg) "Rotate given register leftward by 11." (append (subseq reg 11) (subseq reg 0 11)))   (defmacro reg-xor (&rest regs) "Make algebraic representation of the xor of given registers." `(map 'list #'(lambda (&rest args) (cons 'xor args)) ,@regs))   ;; Define the input registers (defvar *A* (make-reg "a" +bitness+)) (defvar *B* (make-reg "b" +bitness+)) (defvar *C* (make-reg "c" +bitness+)) (defvar *D* (make-reg "d" +bitness+)) (defvar *E* (make-reg "e" +bitness+)) (defvar *F* (make-reg "f" +bitness+)) (defvar *G* (make-reg "g" +bitness+)) (defvar *H* (make-reg "h" +bitness+))   ;; Serpent's 'goldenratio' turd (defconstant +serpent-const+ #x9E3779B9)   ;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;; from serpent.ada: ;;; ;;;;;;;;;;;;;;;;;;;;;;;;;; ;; for I in 0..7 loop ;; W(-8+I) := Bytes_To_Word(K(4*I .. 4*I+3)); ;; end loop; ;; for I in 0..131 loop ;; W(I) := Rotate_Left(W(I-8) xor W(I-5) xor W(I-3) xor W(I-1) xor ;; 16#9e3779b9# xor Unsigned_32(I), 11); ;; end loop;   (defun serp-co-recur (k) "Co-recursive helper" (if (< k 0) (serpent-recurrence k) (make-reg (format nil "W~A-" k) +bitness+)))   (defun serpent-recurrence (k) "Generate k-th term of the Serpent key-expander recurrence equation." (case k ;; The key terms: (-8 *A*) (-7 *B*) (-6 *C*) (-5 *D*) (-4 *E*) (-3 *F*) (-2 *G*) (-1 *H*) ;; Any other term: (t (RL11 (reg-xor (integer-to-reg (logxor +serpent-const+ k)) (serp-co-recur (- k 8)) (serp-co-recur (- k 5)) (serp-co-recur (- k 3)) (serp-co-recur (- k 1)))))))   (defun print-reg-w (w reg stream) "Print algebraic register as table." (let ((l (1- (length reg)))) (loop for i from 0 upto l do (let* ((expr (nth (- l i) reg)) (const (cadr expr)) (terms (cddr expr))) (loop for clause in terms do (format stream " ~7A " clause)) (format stream "~A --> [W~A-~2d]~%" const w i)))))   ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; Print recurrence terms: (with-open-file (stream "serpent_proofolade.txt" :direction :output :if-exists :overwrite :if-does-not-exist :create) (loop for k from 0 upto 131 do (progn (format stream "~%Serpent W(~A):~%" k) (print-reg-w k (serpent-recurrence k) stream))))   (quit)```

We end up with this output. Observe that, starting with W(8):

```Serpent W(8): W0-21 W3-21 W5-21 W7-21 1 --> [W8- 0] W0-22 W3-22 W5-22 W7-22 0 --> [W8- 1] W0-23 W3-23 W5-23 W7-23 0 --> [W8- 2] W0-24 W3-24 W5-24 W7-24 0 --> [W8- 3] W0-25 W3-25 W5-25 W7-25 1 --> [W8- 4] W0-26 W3-26 W5-26 W7-26 1 --> [W8- 5] W0-27 W3-27 W5-27 W7-27 1 --> [W8- 6] W0-28 W3-28 W5-28 W7-28 1 --> [W8- 7] W0-29 W3-29 W5-29 W7-29 0 --> [W8- 8] W0-30 W3-30 W5-30 W7-30 0 --> [W8- 9] W0-31 W3-31 W5-31 W7-31 1 --> [W8-10] W0-0 W3-0 W5-0 W7-0 1 --> [W8-11] W0-1 W3-1 W5-1 W7-1 0 --> [W8-12] W0-2 W3-2 W5-2 W7-2 0 --> [W8-13] W0-3 W3-3 W5-3 W7-3 0 --> [W8-14] W0-4 W3-4 W5-4 W7-4 1 --> [W8-15] W0-5 W3-5 W5-5 W7-5 1 --> [W8-16] W0-6 W3-6 W5-6 W7-6 0 --> [W8-17] W0-7 W3-7 W5-7 W7-7 1 --> [W8-18] W0-8 W3-8 W5-8 W7-8 1 --> [W8-19] W0-9 W3-9 W5-9 W7-9 0 --> [W8-20] W0-10 W3-10 W5-10 W7-10 0 --> [W8-21] W0-11 W3-11 W5-11 W7-11 1 --> [W8-22] W0-12 W3-12 W5-12 W7-12 1 --> [W8-23] W0-13 W3-13 W5-13 W7-13 1 --> [W8-24] W0-14 W3-14 W5-14 W7-14 1 --> [W8-25] W0-15 W3-15 W5-15 W7-15 0 --> [W8-26] W0-16 W3-16 W5-16 W7-16 1 --> [W8-27] W0-17 W3-17 W5-17 W7-17 1 --> [W8-28] W0-18 W3-18 W5-18 W7-18 1 --> [W8-29] W0-19 W3-19 W5-19 W7-19 0 --> [W8-30] W0-20 W3-20 W5-20 W7-20 1 --> [W8-31]```

… no key bits any longer appear directly. Therefore we can constrain the analysis to W (expansion words) 0 through 7.

Now, let’s take the last of these:

```Serpent W(7): h21 W2-21 W4-21 W6-21 1 --> [W7- 0] h22 W2-22 W4-22 W6-22 0 --> [W7- 1] h23 W2-23 W4-23 W6-23 0 --> [W7- 2] h24 W2-24 W4-24 W6-24 0 --> [W7- 3] h25 W2-25 W4-25 W6-25 1 --> [W7- 4] h26 W2-26 W4-26 W6-26 1 --> [W7- 5] h27 W2-27 W4-27 W6-27 1 --> [W7- 6] h28 W2-28 W4-28 W6-28 1 --> [W7- 7] h29 W2-29 W4-29 W6-29 0 --> [W7- 8] h30 W2-30 W4-30 W6-30 0 --> [W7- 9] h31 W2-31 W4-31 W6-31 1 --> [W7-10] h0 W2-0 W4-0 W6-0 0 --> [W7-11] h1 W2-1 W4-1 W6-1 1 --> [W7-12] h2 W2-2 W4-2 W6-2 1 --> [W7-13] h3 W2-3 W4-3 W6-3 1 --> [W7-14] h4 W2-4 W4-4 W6-4 1 --> [W7-15] h5 W2-5 W4-5 W6-5 1 --> [W7-16] h6 W2-6 W4-6 W6-6 0 --> [W7-17] h7 W2-7 W4-7 W6-7 1 --> [W7-18] h8 W2-8 W4-8 W6-8 1 --> [W7-19] h9 W2-9 W4-9 W6-9 0 --> [W7-20] h10 W2-10 W4-10 W6-10 0 --> [W7-21] h11 W2-11 W4-11 W6-11 1 --> [W7-22] h12 W2-12 W4-12 W6-12 1 --> [W7-23] h13 W2-13 W4-13 W6-13 1 --> [W7-24] h14 W2-14 W4-14 W6-14 1 --> [W7-25] h15 W2-15 W4-15 W6-15 0 --> [W7-26] h16 W2-16 W4-16 W6-16 1 --> [W7-27] h17 W2-17 W4-17 W6-17 1 --> [W7-28] h18 W2-18 W4-18 W6-18 1 --> [W7-29] h19 W2-19 W4-19 W6-19 0 --> [W7-30] h20 W2-20 W4-20 W6-20 1 --> [W7-31]```

Observe that, e.g., h21 xor W2-21 xor W4-21 xor W6-21 xor 1, which forms the output bit [W7- 0] , does not permit any alternate value for h21 — given as W2-21, W4-21, and W6-21 must remain fixed. And that the same thing is true for all other bits in the key register H.

Now we continue walking backwards through the expansion:

```Serpent W(6): g21 W1-21 W3-21 W5-21 1 --> [W6- 0] g22 W1-22 W3-22 W5-22 0 --> [W6- 1] g23 W1-23 W3-23 W5-23 0 --> [W6- 2] g24 W1-24 W3-24 W5-24 0 --> [W6- 3] g25 W1-25 W3-25 W5-25 1 --> [W6- 4] g26 W1-26 W3-26 W5-26 1 --> [W6- 5] g27 W1-27 W3-27 W5-27 1 --> [W6- 6] g28 W1-28 W3-28 W5-28 1 --> [W6- 7] g29 W1-29 W3-29 W5-29 0 --> [W6- 8] g30 W1-30 W3-30 W5-30 0 --> [W6- 9] g31 W1-31 W3-31 W5-31 1 --> [W6-10] g0 W1-0 W3-0 W5-0 1 --> [W6-11] g1 W1-1 W3-1 W5-1 1 --> [W6-12] g2 W1-2 W3-2 W5-2 1 --> [W6-13] g3 W1-3 W3-3 W5-3 1 --> [W6-14] g4 W1-4 W3-4 W5-4 1 --> [W6-15] g5 W1-5 W3-5 W5-5 1 --> [W6-16] g6 W1-6 W3-6 W5-6 0 --> [W6-17] g7 W1-7 W3-7 W5-7 1 --> [W6-18] g8 W1-8 W3-8 W5-8 1 --> [W6-19] g9 W1-9 W3-9 W5-9 0 --> [W6-20] g10 W1-10 W3-10 W5-10 0 --> [W6-21] g11 W1-11 W3-11 W5-11 1 --> [W6-22] g12 W1-12 W3-12 W5-12 1 --> [W6-23] g13 W1-13 W3-13 W5-13 1 --> [W6-24] g14 W1-14 W3-14 W5-14 1 --> [W6-25] g15 W1-15 W3-15 W5-15 0 --> [W6-26] g16 W1-16 W3-16 W5-16 1 --> [W6-27] g17 W1-17 W3-17 W5-17 1 --> [W6-28] g18 W1-18 W3-18 W5-18 1 --> [W6-29] g19 W1-19 W3-19 W5-19 0 --> [W6-30] g20 W1-20 W3-20 W5-20 1 --> [W6-31]   Serpent W(5): f21 W0-21 W2-21 W4-21 1 --> [W5- 0] f22 W0-22 W2-22 W4-22 0 --> [W5- 1] f23 W0-23 W2-23 W4-23 0 --> [W5- 2] f24 W0-24 W2-24 W4-24 0 --> [W5- 3] f25 W0-25 W2-25 W4-25 1 --> [W5- 4] f26 W0-26 W2-26 W4-26 1 --> [W5- 5] f27 W0-27 W2-27 W4-27 1 --> [W5- 6] f28 W0-28 W2-28 W4-28 1 --> [W5- 7] f29 W0-29 W2-29 W4-29 0 --> [W5- 8] f30 W0-30 W2-30 W4-30 0 --> [W5- 9] f31 W0-31 W2-31 W4-31 1 --> [W5-10] f0 W0-0 W2-0 W4-0 0 --> [W5-11] f1 W0-1 W2-1 W4-1 0 --> [W5-12] f2 W0-2 W2-2 W4-2 1 --> [W5-13] f3 W0-3 W2-3 W4-3 1 --> [W5-14] f4 W0-4 W2-4 W4-4 1 --> [W5-15] f5 W0-5 W2-5 W4-5 1 --> [W5-16] f6 W0-6 W2-6 W4-6 0 --> [W5-17] f7 W0-7 W2-7 W4-7 1 --> [W5-18] f8 W0-8 W2-8 W4-8 1 --> [W5-19] f9 W0-9 W2-9 W4-9 0 --> [W5-20] f10 W0-10 W2-10 W4-10 0 --> [W5-21] f11 W0-11 W2-11 W4-11 1 --> [W5-22] f12 W0-12 W2-12 W4-12 1 --> [W5-23] f13 W0-13 W2-13 W4-13 1 --> [W5-24] f14 W0-14 W2-14 W4-14 1 --> [W5-25] f15 W0-15 W2-15 W4-15 0 --> [W5-26] f16 W0-16 W2-16 W4-16 1 --> [W5-27] f17 W0-17 W2-17 W4-17 1 --> [W5-28] f18 W0-18 W2-18 W4-18 1 --> [W5-29] f19 W0-19 W2-19 W4-19 0 --> [W5-30] f20 W0-20 W2-20 W4-20 1 --> [W5-31]```

Key registers G and F are nailed down in precisely the same way as H was earlier shown to be. Let’s continue,

```Serpent W(4): e21 h21 W1-21 W3-21 1 --> [W4- 0] e22 h22 W1-22 W3-22 0 --> [W4- 1] e23 h23 W1-23 W3-23 0 --> [W4- 2] e24 h24 W1-24 W3-24 0 --> [W4- 3] e25 h25 W1-25 W3-25 1 --> [W4- 4] e26 h26 W1-26 W3-26 1 --> [W4- 5] e27 h27 W1-27 W3-27 1 --> [W4- 6] e28 h28 W1-28 W3-28 1 --> [W4- 7] e29 h29 W1-29 W3-29 0 --> [W4- 8] e30 h30 W1-30 W3-30 0 --> [W4- 9] e31 h31 W1-31 W3-31 1 --> [W4-10] e0 h0 W1-0 W3-0 1 --> [W4-11] e1 h1 W1-1 W3-1 0 --> [W4-12] e2 h2 W1-2 W3-2 1 --> [W4-13] e3 h3 W1-3 W3-3 1 --> [W4-14] e4 h4 W1-4 W3-4 1 --> [W4-15] e5 h5 W1-5 W3-5 1 --> [W4-16] e6 h6 W1-6 W3-6 0 --> [W4-17] e7 h7 W1-7 W3-7 1 --> [W4-18] e8 h8 W1-8 W3-8 1 --> [W4-19] e9 h9 W1-9 W3-9 0 --> [W4-20] e10 h10 W1-10 W3-10 0 --> [W4-21] e11 h11 W1-11 W3-11 1 --> [W4-22] e12 h12 W1-12 W3-12 1 --> [W4-23] e13 h13 W1-13 W3-13 1 --> [W4-24] e14 h14 W1-14 W3-14 1 --> [W4-25] e15 h15 W1-15 W3-15 0 --> [W4-26] e16 h16 W1-16 W3-16 1 --> [W4-27] e17 h17 W1-17 W3-17 1 --> [W4-28] e18 h18 W1-18 W3-18 1 --> [W4-29] e19 h19 W1-19 W3-19 0 --> [W4-30] e20 h20 W1-20 W3-20 1 --> [W4-31]   Serpent W(3): d21 g21 W0-21 W2-21 1 --> [W3- 0] d22 g22 W0-22 W2-22 0 --> [W3- 1] d23 g23 W0-23 W2-23 0 --> [W3- 2] d24 g24 W0-24 W2-24 0 --> [W3- 3] d25 g25 W0-25 W2-25 1 --> [W3- 4] d26 g26 W0-26 W2-26 1 --> [W3- 5] d27 g27 W0-27 W2-27 1 --> [W3- 6] d28 g28 W0-28 W2-28 1 --> [W3- 7] d29 g29 W0-29 W2-29 0 --> [W3- 8] d30 g30 W0-30 W2-30 0 --> [W3- 9] d31 g31 W0-31 W2-31 1 --> [W3-10] d0 g0 W0-0 W2-0 0 --> [W3-11] d1 g1 W0-1 W2-1 1 --> [W3-12] d2 g2 W0-2 W2-2 0 --> [W3-13] d3 g3 W0-3 W2-3 1 --> [W3-14] d4 g4 W0-4 W2-4 1 --> [W3-15] d5 g5 W0-5 W2-5 1 --> [W3-16] d6 g6 W0-6 W2-6 0 --> [W3-17] d7 g7 W0-7 W2-7 1 --> [W3-18] d8 g8 W0-8 W2-8 1 --> [W3-19] d9 g9 W0-9 W2-9 0 --> [W3-20] d10 g10 W0-10 W2-10 0 --> [W3-21] d11 g11 W0-11 W2-11 1 --> [W3-22] d12 g12 W0-12 W2-12 1 --> [W3-23] d13 g13 W0-13 W2-13 1 --> [W3-24] d14 g14 W0-14 W2-14 1 --> [W3-25] d15 g15 W0-15 W2-15 0 --> [W3-26] d16 g16 W0-16 W2-16 1 --> [W3-27] d17 g17 W0-17 W2-17 1 --> [W3-28] d18 g18 W0-18 W2-18 1 --> [W3-29] d19 g19 W0-19 W2-19 0 --> [W3-30] d20 g20 W0-20 W2-20 1 --> [W3-31]```

Having already found H, G and F to be immovable, we treat their values as constants and find that E and D are also fixed (no bit-flippage is possible in them without affecting the value of a key expansion bit.) Continuing:

```Serpent W(2): c21 f21 h21 W1-21 1 --> [W2- 0] c22 f22 h22 W1-22 0 --> [W2- 1] c23 f23 h23 W1-23 0 --> [W2- 2] c24 f24 h24 W1-24 0 --> [W2- 3] c25 f25 h25 W1-25 1 --> [W2- 4] c26 f26 h26 W1-26 1 --> [W2- 5] c27 f27 h27 W1-27 1 --> [W2- 6] c28 f28 h28 W1-28 1 --> [W2- 7] c29 f29 h29 W1-29 0 --> [W2- 8] c30 f30 h30 W1-30 0 --> [W2- 9] c31 f31 h31 W1-31 1 --> [W2-10] c0 f0 h0 W1-0 1 --> [W2-11] c1 f1 h1 W1-1 1 --> [W2-12] c2 f2 h2 W1-2 0 --> [W2-13] c3 f3 h3 W1-3 1 --> [W2-14] c4 f4 h4 W1-4 1 --> [W2-15] c5 f5 h5 W1-5 1 --> [W2-16] c6 f6 h6 W1-6 0 --> [W2-17] c7 f7 h7 W1-7 1 --> [W2-18] c8 f8 h8 W1-8 1 --> [W2-19] c9 f9 h9 W1-9 0 --> [W2-20] c10 f10 h10 W1-10 0 --> [W2-21] c11 f11 h11 W1-11 1 --> [W2-22] c12 f12 h12 W1-12 1 --> [W2-23] c13 f13 h13 W1-13 1 --> [W2-24] c14 f14 h14 W1-14 1 --> [W2-25] c15 f15 h15 W1-15 0 --> [W2-26] c16 f16 h16 W1-16 1 --> [W2-27] c17 f17 h17 W1-17 1 --> [W2-28] c18 f18 h18 W1-18 1 --> [W2-29] c19 f19 h19 W1-19 0 --> [W2-30] c20 f20 h20 W1-20 1 --> [W2-31]```

Key register C is nailed down;

```Serpent W(1): b21 e21 g21 W0-21 1 --> [W1- 0] b22 e22 g22 W0-22 0 --> [W1- 1] b23 e23 g23 W0-23 0 --> [W1- 2] b24 e24 g24 W0-24 0 --> [W1- 3] b25 e25 g25 W0-25 1 --> [W1- 4] b26 e26 g26 W0-26 1 --> [W1- 5] b27 e27 g27 W0-27 1 --> [W1- 6] b28 e28 g28 W0-28 1 --> [W1- 7] b29 e29 g29 W0-29 0 --> [W1- 8] b30 e30 g30 W0-30 0 --> [W1- 9] b31 e31 g31 W0-31 1 --> [W1-10] b0 e0 g0 W0-0 0 --> [W1-11] b1 e1 g1 W0-1 0 --> [W1-12] b2 e2 g2 W0-2 0 --> [W1-13] b3 e3 g3 W0-3 1 --> [W1-14] b4 e4 g4 W0-4 1 --> [W1-15] b5 e5 g5 W0-5 1 --> [W1-16] b6 e6 g6 W0-6 0 --> [W1-17] b7 e7 g7 W0-7 1 --> [W1-18] b8 e8 g8 W0-8 1 --> [W1-19] b9 e9 g9 W0-9 0 --> [W1-20] b10 e10 g10 W0-10 0 --> [W1-21] b11 e11 g11 W0-11 1 --> [W1-22] b12 e12 g12 W0-12 1 --> [W1-23] b13 e13 g13 W0-13 1 --> [W1-24] b14 e14 g14 W0-14 1 --> [W1-25] b15 e15 g15 W0-15 0 --> [W1-26] b16 e16 g16 W0-16 1 --> [W1-27] b17 e17 g17 W0-17 1 --> [W1-28] b18 e18 g18 W0-18 1 --> [W1-29] b19 e19 g19 W0-19 0 --> [W1-30] b20 e20 g20 W0-20 1 --> [W1-31]```

… and B;

```Serpent W(0): a21 d21 f21 h21 1 --> [W0- 0] a22 d22 f22 h22 0 --> [W0- 1] a23 d23 f23 h23 0 --> [W0- 2] a24 d24 f24 h24 0 --> [W0- 3] a25 d25 f25 h25 1 --> [W0- 4] a26 d26 f26 h26 1 --> [W0- 5] a27 d27 f27 h27 1 --> [W0- 6] a28 d28 f28 h28 1 --> [W0- 7] a29 d29 f29 h29 0 --> [W0- 8] a30 d30 f30 h30 0 --> [W0- 9] a31 d31 f31 h31 1 --> [W0-10] a0 d0 f0 h0 1 --> [W0-11] a1 d1 f1 h1 0 --> [W0-12] a2 d2 f2 h2 0 --> [W0-13] a3 d3 f3 h3 1 --> [W0-14] a4 d4 f4 h4 1 --> [W0-15] a5 d5 f5 h5 1 --> [W0-16] a6 d6 f6 h6 0 --> [W0-17] a7 d7 f7 h7 1 --> [W0-18] a8 d8 f8 h8 1 --> [W0-19] a9 d9 f9 h9 0 --> [W0-20] a10 d10 f10 h10 0 --> [W0-21] a11 d11 f11 h11 1 --> [W0-22] a12 d12 f12 h12 1 --> [W0-23] a13 d13 f13 h13 1 --> [W0-24] a14 d14 f14 h14 1 --> [W0-25] a15 d15 f15 h15 0 --> [W0-26] a16 d16 f16 h16 1 --> [W0-27] a17 d17 f17 h17 1 --> [W0-28] a18 d18 f18 h18 1 --> [W0-29] a19 d19 f19 h19 0 --> [W0-30] a20 d20 f20 h20 1 --> [W0-31]```

… and A. Which accounts for the entire key.

There is not, in fact, any possibility of changing any portion of the key without producing a change in an output expansion bit, regardless of what you do. Ergo, we have the previously-sought proof:

The key expander of the Serpent cipher is injective, there are precisely 2256 possible expansions — one for each possible key.

There still could be interesting problems with the expander (e.g., it is — by all indications — reversible) but, at the very least, it is entropy-conserving.

Why the original authors of Serpent did not see it fit to present this proof to the public, I do not know; but now it can be seen here.

The remaining components of the Serpent cipher, we will leave for another time.

~The End~ (For now…)

## The Serpent Cipher’s Key Schedule Equation System, in Graphical Form.

For clarity, we will omit the routines already given in the previous article.

Let’s visualize the Serpent key schedule as a graphic:

```;; 256bit(key)+1(const) x 4224(132*32) matrix, last column for constant subterms (defvar *matrix* (make-array '(257 4224) :element-type '(mod 1)))   ;; All of the 256 key-bits, from a0 .. h31 (defvar *keybits* (append (reverse *a*) (reverse *b*) (reverse *c*) (reverse *d*) (reverse *e*) (reverse *f*) (reverse *g*) (reverse *h*)))   (defun key-bit-pos (keybit) "Find the position of a given key bit token in the 256-bit key." (position keybit *keybits*))   ;; Form the matrix. (loop for k from 0 upto 131 do (let ((terms (serpent-recurrence k))) ;; current w-term (loop for w-bit from 0 upto (1- +bitness+) do ;; current bit of w-term (let* ((w-row (+ (* k +bitness+) w-bit)) (term (nth (1- (- +bitness+ w-bit)) terms)) ;; the constant term (const (if (equal (second term) 1) 1 0)) ;; the free variables (clause (if (zerop const) (cdr term) (cddr term)))) ;; save the free variables into the matrix (loop for var in clause do (setf (aref *matrix* (key-bit-pos var) w-row) 1)) ;; save the constant term into last column of matrix (setf (aref *matrix* 256 w-row) const)))))   ;; let's have it as bitmap: (with-open-file (stream "serpent.pbm" :direction :output :if-exists :overwrite :if-does-not-exist :create) (format stream "P1~%#serpent~%~A ~A~%" 257 4224) (loop for wb from 0 to 4223 do (loop for kb from 0 to 256 do (format stream "~A " (aref *matrix* kb wb))) (format stream "~%")))   (quit)```

From this, we get this rather peculiar item, with a number of obvious (and an unknown number of non-obvious!) regularities:

The rows in this graphic correspond to bits of the Serpent key schedule (prior to the S-Boxing — which is not of interest here, as it is entropy-conserving.) The columns correspond to bits of the input K (the 256-bit key) which appear in the XOR equation which produces that particular bit of the schedule. The final column corresponds to the constant term in the XOR equation.

It seems to me that colliding inputs of K — i.e. K1, K2, Kn which produce identical schedules — are nearly certain to exist, and that Serpent is thereby not in fact a cipher with 256-bit keyspace, contrary to the authors’ claim.
(Spoiler: nope)

The next logical step will be to reduce the system to a XOR-SAT and get at the actual “bitness” of Serpent’s keyspace.
(Spoiler: wasn’t needed)

~To be continued!~

## Serpent Cipher’s Key Schedule in Algebraic Form: with Reduction.

This variant will reduce the equations. We will omit printing the input matrix, for brevity. And so:

```;; Register bitness. (defconstant +bitness+ 32)   (defun flatten (l) "Flatten a tree." (cond ((null l) nil) ((atom l) (list l)) (t (mapcan #'flatten l))))   (defun make-reg (reg-name bitness) "Make algebraic representation of a register (bits in descending majority)" (loop for i from (1- bitness) downto 0 collect (make-symbol (format nil "~A~A" reg-name i))))   (defun integer-to-reg (n &optional (pad-width +bitness+)) "Generate algebraic represenation of the given integer n." (let* ((bits '()) (integer-bitness (integer-length n)) (pad-bitness (- pad-width integer-bitness))) (dotimes (index integer-bitness bits) (push (if (logbitp index n) 1 0) bits)) ;; Append padding zeros, if required to make full width: (loop repeat pad-bitness do (push 0 bits)) bits))   (defun RL11 (reg) "Rotate given register leftward by 11." (append (subseq reg 11) (subseq reg 0 11)))   (defmacro reg-xor (&rest regs) "Make algebraic representation of the xor of given registers." `(map 'list #'(lambda (&rest args) (cons 'xor args)) ,@regs))   (defun print-reg (reg stream) "Print algebraic register as table, in descending bit majority" (let ((l (1- (length reg)))) (loop for i from 0 upto l do (format stream "[bit:~2d] : ~A~%" i (nth (- l i) reg)))))   ;; Define the input registers (defvar *A* (make-reg "a" +bitness+)) (defvar *B* (make-reg "b" +bitness+)) (defvar *C* (make-reg "c" +bitness+)) (defvar *D* (make-reg "d" +bitness+)) (defvar *E* (make-reg "e" +bitness+)) (defvar *F* (make-reg "f" +bitness+)) (defvar *G* (make-reg "g" +bitness+)) (defvar *H* (make-reg "h" +bitness+))   ;; Serpent's 'goldenratio' turd (defconstant +serpent-const+ #x9E3779B9)   ;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;; from serpent.ada: ;;; ;;;;;;;;;;;;;;;;;;;;;;;;;; ;; for I in 0..7 loop ;; W(-8+I) := Bytes_To_Word(K(4*I .. 4*I+3)); ;; end loop; ;; for I in 0..131 loop ;; W(I) := Rotate_Left(W(I-8) xor W(I-5) xor W(I-3) xor W(I-1) xor ;; 16#9e3779b9# xor Unsigned_32(I), 11); ;; end loop;   (defun simplify-term (term) "Simplify algebraic term containing XOR, constants, and registers." (let ((constants '()) (variables '()) (flattened-term (remove 'XOR (flatten term)))) (loop for subterm in flattened-term do (if (numberp subterm) (push subterm constants) (push subterm variables))) (cons 'XOR (let ((constant-term (apply #'logxor constants))) (if (zerop constant-term) variables (cons constant-term variables))))))   (defun cancel-xor-subterms (expr) "Cancel subterms of flat equation which appear even number of times." (let ((subterms (cdr expr))) ;; lose the 'XOR (cons 'XOR (remove-duplicates (loop for subterm in subterms when (oddp (count subterm subterms)) collect subterm)))))   (defun simplify-reg (reg) "Simplify every bit's equation, in a register." (loop for bit in reg collect (cancel-xor-subterms (simplify-term bit))))   ;; Memoization for recurrence terms (defvar *recurr-memo* (make-hash-table))   (defun get-memo (k) "Get memoized term k, if it exists" (gethash k *recurr-memo*))   (defun put-memo (k term) "Memoize k-th term." (setf (gethash k *recurr-memo*) term))   (defun serpent-recurrence (k) "Generate k-th term of the Serpent key-expander recurrence equation." (let ((memo (get-memo k))) (if memo memo (put-memo k (case k ;; The key terms: (-8 *A*) (-7 *B*) (-6 *C*) (-5 *D*) (-4 *E*) (-3 *F*) (-2 *G*) (-1 *H*) ;; Any other term: (t (simplify-reg (RL11 (reg-xor (integer-to-reg (logxor +serpent-const+ k)) (serpent-recurrence (- k 8)) (serpent-recurrence (- k 5)) (serpent-recurrence (- k 3)) (serpent-recurrence (- k 1)))))))))))   ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; Print recurrence terms from 0 to 131:   (with-open-file (stream "serpent_with_reduction.txt" :direction :output :if-exists :overwrite :if-does-not-exist :create) (loop for k from 0 upto 131 do (progn (format stream "~%Serpent W(~A):~%" k) (print-reg (serpent-recurrence k) stream))))   (quit)```

Producing, in half a minute or so:
this.

Observe that expressions of the form (XOR 1 …) are equivalent to a NOT (XOR …).

In the next and final article in this series… the money shot!

~To be continued!~

## Terms -8…8 of the Serpent Cipher’s Key Schedule in Algebraic Form.

Behold:

```;; Register bitness. (defconstant +bitness+ 32)   (defun make-reg (reg-name bitness) "Make algebraic representation of a register (bits in descending majority)" (loop for i from (1- bitness) downto 0 collect (make-symbol (format nil "~A~A" reg-name i))))   (defun integer-to-reg (n &optional (pad-width +bitness+)) "Generate algebraic represenation of the given integer n." (let* ((bits '()) (integer-bitness (integer-length n)) (pad-bitness (- pad-width integer-bitness))) (dotimes (index integer-bitness bits) (push (if (logbitp index n) 1 0) bits)) ;; Append padding zeros, if required to make full width: (loop repeat pad-bitness do (push 0 bits)) bits))   (defun RL11 (reg) "Rotate given register leftward by 11." (append (subseq reg 11) (subseq reg 0 11)))   (defmacro reg-xor (&rest regs) "Make algebraic representation of the xor of given registers." `(map 'list #'(lambda (&rest args) (cons 'xor args)) ,@regs))   (defun print-reg (reg) "Print algebraic register as table, in descending bit majority" (let ((l (1- (length reg)))) (loop for i from 0 upto l do (format t "[bit:~2d] : ~A~%" i (nth (- l i) reg)))))   ;; Define the input registers (defvar *A* (make-reg "a" +bitness+)) (defvar *B* (make-reg "b" +bitness+)) (defvar *C* (make-reg "c" +bitness+)) (defvar *D* (make-reg "d" +bitness+)) (defvar *E* (make-reg "e" +bitness+)) (defvar *F* (make-reg "f" +bitness+)) (defvar *G* (make-reg "g" +bitness+)) (defvar *H* (make-reg "h" +bitness+))   ;; Serpent's 'goldenratio' turd (defconstant +serpent-const+ #x9E3779B9)   ;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;; from serpent.ada: ;;; ;;;;;;;;;;;;;;;;;;;;;;;;;; ;; for I in 0..7 loop ;; W(-8+I) := Bytes_To_Word(K(4*I .. 4*I+3)); ;; end loop; ;; for I in 0..131 loop ;; W(I) := Rotate_Left(W(I-8) xor W(I-5) xor W(I-3) xor W(I-1) xor ;; 16#9e3779b9# xor Unsigned_32(I), 11); ;; end loop;   (defun serpent-recurrence (k) "Generate k-th term of the Serpent key-expander recurrence equation." (case k ;; The key terms: (-8 *A*) (-7 *B*) (-6 *C*) (-5 *D*) (-4 *E*) (-3 *F*) (-2 *G*) (-1 *H*) ;; Any other term: (t (RL11 (reg-xor (integer-to-reg (logxor +serpent-const+ k)) (serpent-recurrence (- k 8)) (serpent-recurrence (- k 5)) (serpent-recurrence (- k 3)) (serpent-recurrence (- k 1)))))))   (defun print-serpent-recurrent-term (k) "Print k-th term of the serpent key-expander recurrence equation." (format t "~%Serpent W(~A):~%" k) (print-reg (serpent-recurrence k)))   ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; Print recurrence terms from -8 to 8: (loop for k from -8 upto 8 do (print-serpent-recurrent-term k)) ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;```

Producing the following output:

```Serpent W(-8): [bit: 0] : a0 [bit: 1] : a1 [bit: 2] : a2 [bit: 3] : a3 [bit: 4] : a4 [bit: 5] : a5 [bit: 6] : a6 [bit: 7] : a7 [bit: 8] : a8 [bit: 9] : a9 [bit:10] : a10 [bit:11] : a11 [bit:12] : a12 [bit:13] : a13 [bit:14] : a14 [bit:15] : a15 [bit:16] : a16 [bit:17] : a17 [bit:18] : a18 [bit:19] : a19 [bit:20] : a20 [bit:21] : a21 [bit:22] : a22 [bit:23] : a23 [bit:24] : a24 [bit:25] : a25 [bit:26] : a26 [bit:27] : a27 [bit:28] : a28 [bit:29] : a29 [bit:30] : a30 [bit:31] : a31   Serpent W(-7): [bit: 0] : b0 [bit: 1] : b1 [bit: 2] : b2 [bit: 3] : b3 [bit: 4] : b4 [bit: 5] : b5 [bit: 6] : b6 [bit: 7] : b7 [bit: 8] : b8 [bit: 9] : b9 [bit:10] : b10 [bit:11] : b11 [bit:12] : b12 [bit:13] : b13 [bit:14] : b14 [bit:15] : b15 [bit:16] : b16 [bit:17] : b17 [bit:18] : b18 [bit:19] : b19 [bit:20] : b20 [bit:21] : b21 [bit:22] : b22 [bit:23] : b23 [bit:24] : b24 [bit:25] : b25 [bit:26] : b26 [bit:27] : b27 [bit:28] : b28 [bit:29] : b29 [bit:30] : b30 [bit:31] : b31   Serpent W(-6): [bit: 0] : c0 [bit: 1] : c1 [bit: 2] : c2 [bit: 3] : c3 [bit: 4] : c4 [bit: 5] : c5 [bit: 6] : c6 [bit: 7] : c7 [bit: 8] : c8 [bit: 9] : c9 [bit:10] : c10 [bit:11] : c11 [bit:12] : c12 [bit:13] : c13 [bit:14] : c14 [bit:15] : c15 [bit:16] : c16 [bit:17] : c17 [bit:18] : c18 [bit:19] : c19 [bit:20] : c20 [bit:21] : c21 [bit:22] : c22 [bit:23] : c23 [bit:24] : c24 [bit:25] : c25 [bit:26] : c26 [bit:27] : c27 [bit:28] : c28 [bit:29] : c29 [bit:30] : c30 [bit:31] : c31   Serpent W(-5): [bit: 0] : d0 [bit: 1] : d1 [bit: 2] : d2 [bit: 3] : d3 [bit: 4] : d4 [bit: 5] : d5 [bit: 6] : d6 [bit: 7] : d7 [bit: 8] : d8 [bit: 9] : d9 [bit:10] : d10 [bit:11] : d11 [bit:12] : d12 [bit:13] : d13 [bit:14] : d14 [bit:15] : d15 [bit:16] : d16 [bit:17] : d17 [bit:18] : d18 [bit:19] : d19 [bit:20] : d20 [bit:21] : d21 [bit:22] : d22 [bit:23] : d23 [bit:24] : d24 [bit:25] : d25 [bit:26] : d26 [bit:27] : d27 [bit:28] : d28 [bit:29] : d29 [bit:30] : d30 [bit:31] : d31   Serpent W(-4): [bit: 0] : e0 [bit: 1] : e1 [bit: 2] : e2 [bit: 3] : e3 [bit: 4] : e4 [bit: 5] : e5 [bit: 6] : e6 [bit: 7] : e7 [bit: 8] : e8 [bit: 9] : e9 [bit:10] : e10 [bit:11] : e11 [bit:12] : e12 [bit:13] : e13 [bit:14] : e14 [bit:15] : e15 [bit:16] : e16 [bit:17] : e17 [bit:18] : e18 [bit:19] : e19 [bit:20] : e20 [bit:21] : e21 [bit:22] : e22 [bit:23] : e23 [bit:24] : e24 [bit:25] : e25 [bit:26] : e26 [bit:27] : e27 [bit:28] : e28 [bit:29] : e29 [bit:30] : e30 [bit:31] : e31   Serpent W(-3): [bit: 0] : f0 [bit: 1] : f1 [bit: 2] : f2 [bit: 3] : f3 [bit: 4] : f4 [bit: 5] : f5 [bit: 6] : f6 [bit: 7] : f7 [bit: 8] : f8 [bit: 9] : f9 [bit:10] : f10 [bit:11] : f11 [bit:12] : f12 [bit:13] : f13 [bit:14] : f14 [bit:15] : f15 [bit:16] : f16 [bit:17] : f17 [bit:18] : f18 [bit:19] : f19 [bit:20] : f20 [bit:21] : f21 [bit:22] : f22 [bit:23] : f23 [bit:24] : f24 [bit:25] : f25 [bit:26] : f26 [bit:27] : f27 [bit:28] : f28 [bit:29] : f29 [bit:30] : f30 [bit:31] : f31   Serpent W(-2): [bit: 0] : g0 [bit: 1] : g1 [bit: 2] : g2 [bit: 3] : g3 [bit: 4] : g4 [bit: 5] : g5 [bit: 6] : g6 [bit: 7] : g7 [bit: 8] : g8 [bit: 9] : g9 [bit:10] : g10 [bit:11] : g11 [bit:12] : g12 [bit:13] : g13 [bit:14] : g14 [bit:15] : g15 [bit:16] : g16 [bit:17] : g17 [bit:18] : g18 [bit:19] : g19 [bit:20] : g20 [bit:21] : g21 [bit:22] : g22 [bit:23] : g23 [bit:24] : g24 [bit:25] : g25 [bit:26] : g26 [bit:27] : g27 [bit:28] : g28 [bit:29] : g29 [bit:30] : g30 [bit:31] : g31   Serpent W(-1): [bit: 0] : h0 [bit: 1] : h1 [bit: 2] : h2 [bit: 3] : h3 [bit: 4] : h4 [bit: 5] : h5 [bit: 6] : h6 [bit: 7] : h7 [bit: 8] : h8 [bit: 9] : h9 [bit:10] : h10 [bit:11] : h11 [bit:12] : h12 [bit:13] : h13 [bit:14] : h14 [bit:15] : h15 [bit:16] : h16 [bit:17] : h17 [bit:18] : h18 [bit:19] : h19 [bit:20] : h20 [bit:21] : h21 [bit:22] : h22 [bit:23] : h23 [bit:24] : h24 [bit:25] : h25 [bit:26] : h26 [bit:27] : h27 [bit:28] : h28 [bit:29] : h29 [bit:30] : h30 [bit:31] : h31   Serpent W(0): [bit: 0] : (XOR 1 a21 d21 f21 h21) [bit: 1] : (XOR 0 a22 d22 f22 h22) [bit: 2] : (XOR 0 a23 d23 f23 h23) [bit: 3] : (XOR 0 a24 d24 f24 h24) [bit: 4] : (XOR 1 a25 d25 f25 h25) [bit: 5] : (XOR 1 a26 d26 f26 h26) [bit: 6] : (XOR 1 a27 d27 f27 h27) [bit: 7] : (XOR 1 a28 d28 f28 h28) [bit: 8] : (XOR 0 a29 d29 f29 h29) [bit: 9] : (XOR 0 a30 d30 f30 h30) [bit:10] : (XOR 1 a31 d31 f31 h31) [bit:11] : (XOR 1 a0 d0 f0 h0) [bit:12] : (XOR 0 a1 d1 f1 h1) [bit:13] : (XOR 0 a2 d2 f2 h2) [bit:14] : (XOR 1 a3 d3 f3 h3) [bit:15] : (XOR 1 a4 d4 f4 h4) [bit:16] : (XOR 1 a5 d5 f5 h5) [bit:17] : (XOR 0 a6 d6 f6 h6) [bit:18] : (XOR 1 a7 d7 f7 h7) [bit:19] : (XOR 1 a8 d8 f8 h8) [bit:20] : (XOR 0 a9 d9 f9 h9) [bit:21] : (XOR 0 a10 d10 f10 h10) [bit:22] : (XOR 1 a11 d11 f11 h11) [bit:23] : (XOR 1 a12 d12 f12 h12) [bit:24] : (XOR 1 a13 d13 f13 h13) [bit:25] : (XOR 1 a14 d14 f14 h14) [bit:26] : (XOR 0 a15 d15 f15 h15) [bit:27] : (XOR 1 a16 d16 f16 h16) [bit:28] : (XOR 1 a17 d17 f17 h17) [bit:29] : (XOR 1 a18 d18 f18 h18) [bit:30] : (XOR 0 a19 d19 f19 h19) [bit:31] : (XOR 1 a20 d20 f20 h20)   Serpent W(1): [bit: 0] : (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)) [bit: 1] : (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)) [bit: 2] : (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)) [bit: 3] : (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)) [bit: 4] : (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)) [bit: 5] : (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)) [bit: 6] : (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)) [bit: 7] : (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)) [bit: 8] : (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)) [bit: 9] : (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)) [bit:10] : (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)) [bit:11] : (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)) [bit:12] : (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)) [bit:13] : (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)) [bit:14] : (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)) [bit:15] : (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)) [bit:16] : (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)) [bit:17] : (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)) [bit:18] : (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)) [bit:19] : (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)) [bit:20] : (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)) [bit:21] : (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)) [bit:22] : (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)) [bit:23] : (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)) [bit:24] : (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)) [bit:25] : (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)) [bit:26] : (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)) [bit:27] : (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)) [bit:28] : (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)) [bit:29] : (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)) [bit:30] : (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)) [bit:31] : (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))   Serpent W(2): [bit: 0] : (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))) [bit: 1] : (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))) [bit: 2] : (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))) [bit: 3] : (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))) [bit: 4] : (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))) [bit: 5] : (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))) [bit: 6] : (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))) [bit: 7] : (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))) [bit: 8] : (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))) [bit: 9] : (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))) [bit:10] : (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))) [bit:11] : (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))) [bit:12] : (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))) [bit:13] : (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))) [bit:14] : (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))) [bit:15] : (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))) [bit:16] : (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))) [bit:17] : (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))) [bit:18] : (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))) [bit:19] : (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))) [bit:20] : (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))) [bit:21] : (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))) [bit:22] : (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))) [bit:23] : (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))) [bit:24] : (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))) [bit:25] : (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))) [bit:26] : (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))) [bit:27] : (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))) [bit:28] : (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))) [bit:29] : (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))) [bit:30] : (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))) [bit:31] : (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))   Serpent W(3): [bit: 0] : (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10) (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))) [bit: 1] : (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11) (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))) [bit: 2] : (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12) (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))) [bit: 3] : (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13) (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))) [bit: 4] : (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14) (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))) [bit: 5] : (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15) (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))) [bit: 6] : (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16) (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))) [bit: 7] : (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17) (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))) [bit: 8] : (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18) (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))) [bit: 9] : (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19) (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)))) [bit:10] : (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20) (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))) [bit:11] : (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21) (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))) [bit:12] : (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22) (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))) [bit:13] : (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23) (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))) [bit:14] : (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24) (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))) [bit:15] : (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25) (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))) [bit:16] : (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26) (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))) [bit:17] : (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27) (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))) [bit:18] : (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28) (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))) [bit:19] : (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29) (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)))) [bit:20] : (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30) (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))) [bit:21] : (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31) (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))) [bit:22] : (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0) (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))) [bit:23] : (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1) (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))) [bit:24] : (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2) (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))) [bit:25] : (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3) (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))) [bit:26] : (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4) (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))) [bit:27] : (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5) (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))) [bit:28] : (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6) (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))) [bit:29] : (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7) (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))) [bit:30] : (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8) (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))) [bit:31] : (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9) (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))))   Serpent W(4): [bit: 0] : (XOR 1 e21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)) (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31) (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))))) [bit: 1] : (XOR 0 e22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)) (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0) (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))))) [bit: 2] : (XOR 0 e23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)) (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1) (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))))) [bit: 3] : (XOR 0 e24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)) (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2) (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))))) [bit: 4] : (XOR 1 e25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)) (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3) (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))))) [bit: 5] : (XOR 1 e26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)) (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4) (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))))) [bit: 6] : (XOR 1 e27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)) (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5) (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))))) [bit: 7] : (XOR 1 e28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)) (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6) (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))))) [bit: 8] : (XOR 0 e29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)) (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7) (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))))) [bit: 9] : (XOR 0 e30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)) (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8) (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))))) [bit:10] : (XOR 1 e31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)) (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9) (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))))) [bit:11] : (XOR 1 e0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)) (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10) (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))))) [bit:12] : (XOR 0 e1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)) (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11) (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))))) [bit:13] : (XOR 1 e2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)) (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12) (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))))) [bit:14] : (XOR 1 e3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)) (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13) (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))))) [bit:15] : (XOR 1 e4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)) (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14) (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))))) [bit:16] : (XOR 1 e5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)) (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15) (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))))) [bit:17] : (XOR 0 e6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)) (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16) (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))))) [bit:18] : (XOR 1 e7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)) (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17) (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))))) [bit:19] : (XOR 1 e8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)) (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18) (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))))) [bit:20] : (XOR 0 e9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)) (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19) (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))))) [bit:21] : (XOR 0 e10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)) (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20) (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))))) [bit:22] : (XOR 1 e11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)) (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21) (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))))) [bit:23] : (XOR 1 e12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)) (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22) (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))))) [bit:24] : (XOR 1 e13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)) (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23) (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))))) [bit:25] : (XOR 1 e14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)) (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24) (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))))) [bit:26] : (XOR 0 e15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)) (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25) (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))))) [bit:27] : (XOR 1 e16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)) (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26) (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))))) [bit:28] : (XOR 1 e17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)) (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27) (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))))) [bit:29] : (XOR 1 e18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)) (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28) (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))))) [bit:30] : (XOR 0 e19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)) (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29) (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))))) [bit:31] : (XOR 1 e20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)) (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30) (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))))   Serpent W(5): [bit: 0] : (XOR 1 f21 (XOR 0 a10 d10 f10 h10) (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))) (XOR 0 e10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)) (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20) (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))))) [bit: 1] : (XOR 0 f22 (XOR 1 a11 d11 f11 h11) (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))) (XOR 1 e11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)) (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21) (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))))) [bit: 2] : (XOR 0 f23 (XOR 1 a12 d12 f12 h12) (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))) (XOR 1 e12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)) (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22) (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))))) [bit: 3] : (XOR 0 f24 (XOR 1 a13 d13 f13 h13) (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))) (XOR 1 e13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)) (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23) (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))))) [bit: 4] : (XOR 1 f25 (XOR 1 a14 d14 f14 h14) (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))) (XOR 1 e14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)) (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24) (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))))) [bit: 5] : (XOR 1 f26 (XOR 0 a15 d15 f15 h15) (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))) (XOR 0 e15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)) (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25) (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))))) [bit: 6] : (XOR 1 f27 (XOR 1 a16 d16 f16 h16) (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))) (XOR 1 e16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)) (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26) (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))))) [bit: 7] : (XOR 1 f28 (XOR 1 a17 d17 f17 h17) (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))) (XOR 1 e17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)) (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27) (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))))) [bit: 8] : (XOR 0 f29 (XOR 1 a18 d18 f18 h18) (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))) (XOR 1 e18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)) (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28) (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))))) [bit: 9] : (XOR 0 f30 (XOR 0 a19 d19 f19 h19) (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))) (XOR 0 e19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)) (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29) (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)))))) [bit:10] : (XOR 1 f31 (XOR 1 a20 d20 f20 h20) (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))) (XOR 1 e20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)) (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30) (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))))) [bit:11] : (XOR 0 f0 (XOR 1 a21 d21 f21 h21) (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))) (XOR 1 e21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)) (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31) (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))))) [bit:12] : (XOR 0 f1 (XOR 0 a22 d22 f22 h22) (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))) (XOR 0 e22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)) (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0) (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))))) [bit:13] : (XOR 1 f2 (XOR 0 a23 d23 f23 h23) (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))) (XOR 0 e23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)) (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1) (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))))) [bit:14] : (XOR 1 f3 (XOR 0 a24 d24 f24 h24) (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))) (XOR 0 e24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)) (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2) (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))))) [bit:15] : (XOR 1 f4 (XOR 1 a25 d25 f25 h25) (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))) (XOR 1 e25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)) (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3) (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))))) [bit:16] : (XOR 1 f5 (XOR 1 a26 d26 f26 h26) (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))) (XOR 1 e26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)) (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4) (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))))) [bit:17] : (XOR 0 f6 (XOR 1 a27 d27 f27 h27) (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))) (XOR 1 e27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)) (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5) (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))))) [bit:18] : (XOR 1 f7 (XOR 1 a28 d28 f28 h28) (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))) (XOR 1 e28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)) (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6) (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))))) [bit:19] : (XOR 1 f8 (XOR 0 a29 d29 f29 h29) (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))) (XOR 0 e29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)) (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7) (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))))) [bit:20] : (XOR 0 f9 (XOR 0 a30 d30 f30 h30) (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))) (XOR 0 e30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)) (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8) (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))))) [bit:21] : (XOR 0 f10 (XOR 1 a31 d31 f31 h31) (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))) (XOR 1 e31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)) (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9) (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)))))) [bit:22] : (XOR 1 f11 (XOR 1 a0 d0 f0 h0) (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))) (XOR 1 e0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)) (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10) (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))))) [bit:23] : (XOR 1 f12 (XOR 0 a1 d1 f1 h1) (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))) (XOR 0 e1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)) (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11) (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))))) [bit:24] : (XOR 1 f13 (XOR 0 a2 d2 f2 h2) (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))) (XOR 1 e2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)) (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12) (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))))) [bit:25] : (XOR 1 f14 (XOR 1 a3 d3 f3 h3) (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))) (XOR 1 e3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)) (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13) (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))))) [bit:26] : (XOR 0 f15 (XOR 1 a4 d4 f4 h4) (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))) (XOR 1 e4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)) (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14) (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))))) [bit:27] : (XOR 1 f16 (XOR 1 a5 d5 f5 h5) (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))) (XOR 1 e5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)) (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15) (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))))) [bit:28] : (XOR 1 f17 (XOR 0 a6 d6 f6 h6) (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))) (XOR 0 e6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)) (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16) (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))))) [bit:29] : (XOR 1 f18 (XOR 1 a7 d7 f7 h7) (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))) (XOR 1 e7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)) (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17) (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))))) [bit:30] : (XOR 0 f19 (XOR 1 a8 d8 f8 h8) (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))) (XOR 1 e8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)) (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18) (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))))) [bit:31] : (XOR 1 f20 (XOR 0 a9 d9 f9 h9) (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))) (XOR 0 e9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)) (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19) (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))))))   Serpent W(6): [bit: 0] : (XOR 1 g21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)) (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31) (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))) (XOR 0 f10 (XOR 1 a31 d31 f31 h31) (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))) (XOR 1 e31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)) (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9) (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))))))) [bit: 1] : (XOR 0 g22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)) (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0) (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))) (XOR 1 f11 (XOR 1 a0 d0 f0 h0) (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))) (XOR 1 e0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)) (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10) (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))))))) [bit: 2] : (XOR 0 g23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)) (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1) (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))) (XOR 1 f12 (XOR 0 a1 d1 f1 h1) (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))) (XOR 0 e1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)) (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11) (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))))))) [bit: 3] : (XOR 0 g24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)) (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2) (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))) (XOR 1 f13 (XOR 0 a2 d2 f2 h2) (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))) (XOR 1 e2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)) (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12) (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))))))) [bit: 4] : (XOR 1 g25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)) (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3) (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))) (XOR 1 f14 (XOR 1 a3 d3 f3 h3) (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))) (XOR 1 e3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)) (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13) (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))))))) [bit: 5] : (XOR 1 g26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)) (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4) (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))) (XOR 0 f15 (XOR 1 a4 d4 f4 h4) (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))) (XOR 1 e4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)) (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14) (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))))))) [bit: 6] : (XOR 1 g27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)) (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5) (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))) (XOR 1 f16 (XOR 1 a5 d5 f5 h5) (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))) (XOR 1 e5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)) (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15) (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))))))) [bit: 7] : (XOR 1 g28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)) (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6) (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))) (XOR 1 f17 (XOR 0 a6 d6 f6 h6) (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))) (XOR 0 e6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)) (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16) (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))))))) [bit: 8] : (XOR 0 g29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)) (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7) (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))) (XOR 1 f18 (XOR 1 a7 d7 f7 h7) (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))) (XOR 1 e7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)) (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17) (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))))))) [bit: 9] : (XOR 0 g30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)) (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8) (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))) (XOR 0 f19 (XOR 1 a8 d8 f8 h8) (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))) (XOR 1 e8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)) (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18) (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))))))) [bit:10] : (XOR 1 g31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)) (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9) (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)))) (XOR 1 f20 (XOR 0 a9 d9 f9 h9) (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))) (XOR 0 e9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)) (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19) (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))))))) [bit:11] : (XOR 1 g0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)) (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10) (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))) (XOR 1 f21 (XOR 0 a10 d10 f10 h10) (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))) (XOR 0 e10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)) (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20) (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))))))) [bit:12] : (XOR 1 g1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)) (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11) (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))) (XOR 0 f22 (XOR 1 a11 d11 f11 h11) (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))) (XOR 1 e11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)) (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21) (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))))))) [bit:13] : (XOR 1 g2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)) (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12) (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))) (XOR 0 f23 (XOR 1 a12 d12 f12 h12) (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))) (XOR 1 e12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)) (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22) (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))))))) [bit:14] : (XOR 1 g3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)) (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13) (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))) (XOR 0 f24 (XOR 1 a13 d13 f13 h13) (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))) (XOR 1 e13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)) (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23) (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))))))) [bit:15] : (XOR 1 g4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)) (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14) (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))) (XOR 1 f25 (XOR 1 a14 d14 f14 h14) (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))) (XOR 1 e14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)) (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24) (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))))))) [bit:16] : (XOR 1 g5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)) (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15) (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))) (XOR 1 f26 (XOR 0 a15 d15 f15 h15) (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))) (XOR 0 e15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)) (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25) (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))))))) [bit:17] : (XOR 0 g6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)) (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16) (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))) (XOR 1 f27 (XOR 1 a16 d16 f16 h16) (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))) (XOR 1 e16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)) (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26) (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))))))) [bit:18] : (XOR 1 g7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)) (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17) (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))) (XOR 1 f28 (XOR 1 a17 d17 f17 h17) (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))) (XOR 1 e17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)) (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27) (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))))))) [bit:19] : (XOR 1 g8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)) (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18) (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))) (XOR 0 f29 (XOR 1 a18 d18 f18 h18) (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))) (XOR 1 e18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)) (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28) (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))))))) [bit:20] : (XOR 0 g9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)) (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19) (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)))) (XOR 0 f30 (XOR 0 a19 d19 f19 h19) (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))) (XOR 0 e19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)) (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29) (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))))))) [bit:21] : (XOR 0 g10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)) (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20) (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))) (XOR 1 f31 (XOR 1 a20 d20 f20 h20) (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))) (XOR 1 e20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)) (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30) (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))))))) [bit:22] : (XOR 1 g11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)) (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21) (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))) (XOR 0 f0 (XOR 1 a21 d21 f21 h21) (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))) (XOR 1 e21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)) (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31) (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))))))) [bit:23] : (XOR 1 g12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)) (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22) (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))) (XOR 0 f1 (XOR 0 a22 d22 f22 h22) (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))) (XOR 0 e22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)) (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0) (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))))))) [bit:24] : (XOR 1 g13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)) (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23) (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))) (XOR 1 f2 (XOR 0 a23 d23 f23 h23) (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))) (XOR 0 e23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)) (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1) (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))))))) [bit:25] : (XOR 1 g14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)) (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24) (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))) (XOR 1 f3 (XOR 0 a24 d24 f24 h24) (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))) (XOR 0 e24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)) (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2) (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))))))) [bit:26] : (XOR 0 g15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)) (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25) (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))) (XOR 1 f4 (XOR 1 a25 d25 f25 h25) (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))) (XOR 1 e25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)) (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3) (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))))))) [bit:27] : (XOR 1 g16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)) (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26) (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))) (XOR 1 f5 (XOR 1 a26 d26 f26 h26) (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))) (XOR 1 e26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)) (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4) (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))))))) [bit:28] : (XOR 1 g17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)) (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27) (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))) (XOR 0 f6 (XOR 1 a27 d27 f27 h27) (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))) (XOR 1 e27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)) (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5) (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))))))) [bit:29] : (XOR 1 g18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)) (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28) (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))) (XOR 1 f7 (XOR 1 a28 d28 f28 h28) (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))) (XOR 1 e28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)) (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6) (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))))))) [bit:30] : (XOR 0 g19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)) (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29) (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)))) (XOR 1 f8 (XOR 0 a29 d29 f29 h29) (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))) (XOR 0 e29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)) (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7) (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))))))) [bit:31] : (XOR 1 g20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)) (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30) (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))) (XOR 0 f9 (XOR 0 a30 d30 f30 h30) (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))) (XOR 0 e30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)) (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8) (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))))))   Serpent W(7): [bit: 0] : (XOR 1 h21 (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))) (XOR 0 e10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)) (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20) (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))))) (XOR 0 g10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)) (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20) (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))) (XOR 1 f31 (XOR 1 a20 d20 f20 h20) (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))) (XOR 1 e20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)) (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30) (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))))))) [bit: 1] : (XOR 0 h22 (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))) (XOR 1 e11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)) (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21) (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))))) (XOR 1 g11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)) (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21) (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))) (XOR 0 f0 (XOR 1 a21 d21 f21 h21) (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))) (XOR 1 e21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)) (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31) (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))))))) [bit: 2] : (XOR 0 h23 (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))) (XOR 1 e12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)) (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22) (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))))) (XOR 1 g12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)) (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22) (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))) (XOR 0 f1 (XOR 0 a22 d22 f22 h22) (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))) (XOR 0 e22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)) (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0) (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))))))) [bit: 3] : (XOR 0 h24 (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))) (XOR 1 e13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)) (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23) (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))))) (XOR 1 g13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)) (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23) (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))) (XOR 1 f2 (XOR 0 a23 d23 f23 h23) (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))) (XOR 0 e23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)) (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1) (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))))))) [bit: 4] : (XOR 1 h25 (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))) (XOR 1 e14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)) (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24) (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))))) (XOR 1 g14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)) (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24) (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))) (XOR 1 f3 (XOR 0 a24 d24 f24 h24) (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))) (XOR 0 e24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)) (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2) (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))))))) [bit: 5] : (XOR 1 h26 (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))) (XOR 0 e15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)) (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25) (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))))) (XOR 0 g15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)) (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25) (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))) (XOR 1 f4 (XOR 1 a25 d25 f25 h25) (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))) (XOR 1 e25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)) (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3) (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))))))) [bit: 6] : (XOR 1 h27 (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))) (XOR 1 e16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)) (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26) (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))))) (XOR 1 g16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)) (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26) (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))) (XOR 1 f5 (XOR 1 a26 d26 f26 h26) (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))) (XOR 1 e26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)) (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4) (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))))))) [bit: 7] : (XOR 1 h28 (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))) (XOR 1 e17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)) (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27) (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))))) (XOR 1 g17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)) (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27) (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))) (XOR 0 f6 (XOR 1 a27 d27 f27 h27) (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))) (XOR 1 e27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)) (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5) (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))))))) [bit: 8] : (XOR 0 h29 (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))) (XOR 1 e18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)) (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28) (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))))) (XOR 1 g18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)) (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28) (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))) (XOR 1 f7 (XOR 1 a28 d28 f28 h28) (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))) (XOR 1 e28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)) (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6) (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))))))) [bit: 9] : (XOR 0 h30 (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))) (XOR 0 e19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)) (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29) (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))))) (XOR 0 g19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)) (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29) (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)))) (XOR 1 f8 (XOR 0 a29 d29 f29 h29) (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))) (XOR 0 e29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)) (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7) (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))))))) [bit:10] : (XOR 1 h31 (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))) (XOR 1 e20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)) (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30) (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))))) (XOR 1 g20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)) (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30) (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))) (XOR 0 f9 (XOR 0 a30 d30 f30 h30) (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))) (XOR 0 e30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)) (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8) (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))))))) [bit:11] : (XOR 0 h0 (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))) (XOR 1 e21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)) (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31) (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))))) (XOR 1 g21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)) (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31) (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))) (XOR 0 f10 (XOR 1 a31 d31 f31 h31) (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))) (XOR 1 e31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)) (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9) (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)))))))) [bit:12] : (XOR 1 h1 (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))) (XOR 0 e22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)) (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0) (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))))) (XOR 0 g22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)) (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0) (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))) (XOR 1 f11 (XOR 1 a0 d0 f0 h0) (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))) (XOR 1 e0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)) (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10) (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))))))) [bit:13] : (XOR 1 h2 (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))) (XOR 0 e23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)) (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1) (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))))) (XOR 0 g23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)) (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1) (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))) (XOR 1 f12 (XOR 0 a1 d1 f1 h1) (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))) (XOR 0 e1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)) (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11) (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))))))) [bit:14] : (XOR 1 h3 (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))) (XOR 0 e24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)) (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2) (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))))) (XOR 0 g24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)) (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2) (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))) (XOR 1 f13 (XOR 0 a2 d2 f2 h2) (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))) (XOR 1 e2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)) (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12) (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))))))) [bit:15] : (XOR 1 h4 (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))) (XOR 1 e25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)) (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3) (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))))) (XOR 1 g25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)) (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3) (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))) (XOR 1 f14 (XOR 1 a3 d3 f3 h3) (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))) (XOR 1 e3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)) (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13) (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))))))) [bit:16] : (XOR 1 h5 (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))) (XOR 1 e26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)) (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4) (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))))) (XOR 1 g26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)) (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4) (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))) (XOR 0 f15 (XOR 1 a4 d4 f4 h4) (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))) (XOR 1 e4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)) (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14) (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))))))) [bit:17] : (XOR 0 h6 (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))) (XOR 1 e27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)) (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5) (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))))) (XOR 1 g27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)) (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5) (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))) (XOR 1 f16 (XOR 1 a5 d5 f5 h5) (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))) (XOR 1 e5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)) (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15) (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))))))) [bit:18] : (XOR 1 h7 (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))) (XOR 1 e28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)) (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6) (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))))) (XOR 1 g28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)) (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6) (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))) (XOR 1 f17 (XOR 0 a6 d6 f6 h6) (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))) (XOR 0 e6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)) (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16) (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))))))) [bit:19] : (XOR 1 h8 (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))) (XOR 0 e29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)) (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7) (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))))) (XOR 0 g29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)) (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7) (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))) (XOR 1 f18 (XOR 1 a7 d7 f7 h7) (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))) (XOR 1 e7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)) (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17) (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))))))) [bit:20] : (XOR 0 h9 (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))) (XOR 0 e30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)) (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8) (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))))) (XOR 0 g30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)) (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8) (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))) (XOR 0 f19 (XOR 1 a8 d8 f8 h8) (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))) (XOR 1 e8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)) (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18) (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))))))) [bit:21] : (XOR 0 h10 (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))) (XOR 1 e31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)) (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9) (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))))) (XOR 1 g31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)) (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9) (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)))) (XOR 1 f20 (XOR 0 a9 d9 f9 h9) (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))) (XOR 0 e9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)) (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19) (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)))))))) [bit:22] : (XOR 1 h11 (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))) (XOR 1 e0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)) (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10) (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))))) (XOR 1 g0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)) (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10) (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))) (XOR 1 f21 (XOR 0 a10 d10 f10 h10) (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))) (XOR 0 e10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)) (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20) (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))))))) [bit:23] : (XOR 1 h12 (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))) (XOR 0 e1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)) (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11) (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))))) (XOR 1 g1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)) (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11) (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))) (XOR 0 f22 (XOR 1 a11 d11 f11 h11) (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))) (XOR 1 e11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)) (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21) (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))))))) [bit:24] : (XOR 1 h13 (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))) (XOR 1 e2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)) (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12) (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))))) (XOR 1 g2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)) (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12) (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))) (XOR 0 f23 (XOR 1 a12 d12 f12 h12) (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))) (XOR 1 e12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)) (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22) (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))))))) [bit:25] : (XOR 1 h14 (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))) (XOR 1 e3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)) (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13) (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))))) (XOR 1 g3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)) (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13) (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))) (XOR 0 f24 (XOR 1 a13 d13 f13 h13) (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))) (XOR 1 e13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)) (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23) (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))))))) [bit:26] : (XOR 0 h15 (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))) (XOR 1 e4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)) (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14) (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))))) (XOR 1 g4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)) (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14) (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))) (XOR 1 f25 (XOR 1 a14 d14 f14 h14) (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))) (XOR 1 e14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)) (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24) (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))))))) [bit:27] : (XOR 1 h16 (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))) (XOR 1 e5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)) (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15) (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))))) (XOR 1 g5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)) (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15) (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))) (XOR 1 f26 (XOR 0 a15 d15 f15 h15) (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))) (XOR 0 e15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)) (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25) (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))))))) [bit:28] : (XOR 1 h17 (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))) (XOR 0 e6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)) (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16) (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))))) (XOR 0 g6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)) (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16) (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))) (XOR 1 f27 (XOR 1 a16 d16 f16 h16) (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))) (XOR 1 e16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)) (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26) (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))))))) [bit:29] : (XOR 1 h18 (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))) (XOR 1 e7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)) (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17) (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))))) (XOR 1 g7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)) (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17) (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))) (XOR 1 f28 (XOR 1 a17 d17 f17 h17) (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))) (XOR 1 e17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)) (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27) (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))))))) [bit:30] : (XOR 0 h19 (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))) (XOR 1 e8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)) (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18) (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))))) (XOR 1 g8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)) (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18) (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))) (XOR 0 f29 (XOR 1 a18 d18 f18 h18) (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))) (XOR 1 e18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)) (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28) (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))))))) [bit:31] : (XOR 1 h20 (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))) (XOR 0 e9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)) (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19) (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))))) (XOR 0 g9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)) (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19) (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)))) (XOR 0 f30 (XOR 0 a19 d19 f19 h19) (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))) (XOR 0 e19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)) (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29) (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))))))))   Serpent W(8): [bit: 0] : (XOR 1 (XOR 0 a10 d10 f10 h10) (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31) (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))) (XOR 0 f10 (XOR 1 a31 d31 f31 h31) (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))) (XOR 1 e31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)) (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9) (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)))))) (XOR 0 h10 (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))) (XOR 1 e31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)) (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9) (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))))) (XOR 1 g31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)) (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9) (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)))) (XOR 1 f20 (XOR 0 a9 d9 f9 h9) (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))) (XOR 0 e9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)) (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19) (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))))))))) [bit: 1] : (XOR 0 (XOR 1 a11 d11 f11 h11) (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0) (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))) (XOR 1 f11 (XOR 1 a0 d0 f0 h0) (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))) (XOR 1 e0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)) (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10) (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))))) (XOR 1 h11 (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))) (XOR 1 e0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)) (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10) (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))))) (XOR 1 g0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)) (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10) (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))) (XOR 1 f21 (XOR 0 a10 d10 f10 h10) (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))) (XOR 0 e10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)) (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20) (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))))))))) [bit: 2] : (XOR 0 (XOR 1 a12 d12 f12 h12) (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1) (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))) (XOR 1 f12 (XOR 0 a1 d1 f1 h1) (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))) (XOR 0 e1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)) (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11) (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))))) (XOR 1 h12 (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))) (XOR 0 e1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)) (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11) (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))))) (XOR 1 g1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)) (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11) (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))) (XOR 0 f22 (XOR 1 a11 d11 f11 h11) (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))) (XOR 1 e11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)) (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21) (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))))))))) [bit: 3] : (XOR 0 (XOR 1 a13 d13 f13 h13) (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2) (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))) (XOR 1 f13 (XOR 0 a2 d2 f2 h2) (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))) (XOR 1 e2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)) (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12) (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))))) (XOR 1 h13 (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))) (XOR 1 e2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)) (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12) (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))))) (XOR 1 g2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)) (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12) (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))) (XOR 0 f23 (XOR 1 a12 d12 f12 h12) (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))) (XOR 1 e12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)) (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22) (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))))))))) [bit: 4] : (XOR 1 (XOR 1 a14 d14 f14 h14) (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3) (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))) (XOR 1 f14 (XOR 1 a3 d3 f3 h3) (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))) (XOR 1 e3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)) (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13) (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))))) (XOR 1 h14 (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))) (XOR 1 e3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)) (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13) (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))))) (XOR 1 g3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)) (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13) (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))) (XOR 0 f24 (XOR 1 a13 d13 f13 h13) (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))) (XOR 1 e13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)) (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23) (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))))))))) [bit: 5] : (XOR 1 (XOR 0 a15 d15 f15 h15) (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4) (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))) (XOR 0 f15 (XOR 1 a4 d4 f4 h4) (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))) (XOR 1 e4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)) (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14) (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))))) (XOR 0 h15 (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))) (XOR 1 e4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)) (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14) (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))))) (XOR 1 g4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)) (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14) (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))) (XOR 1 f25 (XOR 1 a14 d14 f14 h14) (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))) (XOR 1 e14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)) (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24) (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))))))))) [bit: 6] : (XOR 1 (XOR 1 a16 d16 f16 h16) (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5) (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))) (XOR 1 f16 (XOR 1 a5 d5 f5 h5) (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))) (XOR 1 e5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)) (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15) (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))))) (XOR 1 h16 (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))) (XOR 1 e5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)) (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15) (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))))) (XOR 1 g5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)) (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15) (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))) (XOR 1 f26 (XOR 0 a15 d15 f15 h15) (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))) (XOR 0 e15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)) (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25) (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))))))))) [bit: 7] : (XOR 1 (XOR 1 a17 d17 f17 h17) (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6) (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))) (XOR 1 f17 (XOR 0 a6 d6 f6 h6) (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))) (XOR 0 e6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)) (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16) (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))))) (XOR 1 h17 (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))) (XOR 0 e6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)) (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16) (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))))) (XOR 0 g6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)) (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16) (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))) (XOR 1 f27 (XOR 1 a16 d16 f16 h16) (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))) (XOR 1 e16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)) (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26) (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))))))))) [bit: 8] : (XOR 0 (XOR 1 a18 d18 f18 h18) (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7) (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))) (XOR 1 f18 (XOR 1 a7 d7 f7 h7) (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))) (XOR 1 e7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)) (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17) (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))))) (XOR 1 h18 (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))) (XOR 1 e7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)) (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17) (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))))) (XOR 1 g7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)) (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17) (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))) (XOR 1 f28 (XOR 1 a17 d17 f17 h17) (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))) (XOR 1 e17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)) (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27) (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))))))))) [bit: 9] : (XOR 0 (XOR 0 a19 d19 f19 h19) (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8) (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))) (XOR 0 f19 (XOR 1 a8 d8 f8 h8) (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))) (XOR 1 e8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)) (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18) (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))))) (XOR 0 h19 (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))) (XOR 1 e8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)) (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18) (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))))) (XOR 1 g8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)) (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18) (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))) (XOR 0 f29 (XOR 1 a18 d18 f18 h18) (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))) (XOR 1 e18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)) (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28) (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))))))))) [bit:10] : (XOR 1 (XOR 1 a20 d20 f20 h20) (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9) (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)))) (XOR 1 f20 (XOR 0 a9 d9 f9 h9) (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))) (XOR 0 e9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)) (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19) (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)))))) (XOR 1 h20 (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))) (XOR 0 e9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)) (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19) (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))))) (XOR 0 g9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19)) (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19) (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)))) (XOR 0 f30 (XOR 0 a19 d19 f19 h19) (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))) (XOR 0 e19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)) (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29) (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))))))))) [bit:11] : (XOR 1 (XOR 1 a21 d21 f21 h21) (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10) (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)))) (XOR 1 f21 (XOR 0 a10 d10 f10 h10) (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))) (XOR 0 e10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)) (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20) (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))))) (XOR 1 h21 (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))) (XOR 0 e10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)) (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20) (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))))) (XOR 0 g10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20)) (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20) (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))) (XOR 1 f31 (XOR 1 a20 d20 f20 h20) (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))) (XOR 1 e20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)) (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30) (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))))))))) [bit:12] : (XOR 0 (XOR 0 a22 d22 f22 h22) (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11) (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)))) (XOR 0 f22 (XOR 1 a11 d11 f11 h11) (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))) (XOR 1 e11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)) (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21) (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))))) (XOR 0 h22 (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))) (XOR 1 e11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)) (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21) (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))))) (XOR 1 g11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21)) (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21) (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))) (XOR 0 f0 (XOR 1 a21 d21 f21 h21) (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))) (XOR 1 e21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)) (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31) (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))))))))) [bit:13] : (XOR 0 (XOR 0 a23 d23 f23 h23) (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12) (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)))) (XOR 0 f23 (XOR 1 a12 d12 f12 h12) (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))) (XOR 1 e12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)) (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22) (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))))) (XOR 0 h23 (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))) (XOR 1 e12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)) (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22) (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))))) (XOR 1 g12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22)) (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22) (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))) (XOR 0 f1 (XOR 0 a22 d22 f22 h22) (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))) (XOR 0 e22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)) (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0) (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))))))))) [bit:14] : (XOR 0 (XOR 0 a24 d24 f24 h24) (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13) (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)))) (XOR 0 f24 (XOR 1 a13 d13 f13 h13) (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))) (XOR 1 e13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)) (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23) (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))))) (XOR 0 h24 (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))) (XOR 1 e13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)) (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23) (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))))) (XOR 1 g13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23)) (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23) (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))) (XOR 1 f2 (XOR 0 a23 d23 f23 h23) (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))) (XOR 0 e23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)) (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1) (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))))))))) [bit:15] : (XOR 1 (XOR 1 a25 d25 f25 h25) (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14) (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)))) (XOR 1 f25 (XOR 1 a14 d14 f14 h14) (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))) (XOR 1 e14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)) (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24) (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))))) (XOR 1 h25 (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))) (XOR 1 e14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)) (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24) (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))))) (XOR 1 g14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24)) (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24) (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))) (XOR 1 f3 (XOR 0 a24 d24 f24 h24) (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))) (XOR 0 e24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)) (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2) (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))))))))) [bit:16] : (XOR 1 (XOR 1 a26 d26 f26 h26) (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15) (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)))) (XOR 1 f26 (XOR 0 a15 d15 f15 h15) (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))) (XOR 0 e15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)) (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25) (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))))) (XOR 1 h26 (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))) (XOR 0 e15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)) (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25) (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))))) (XOR 0 g15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25)) (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25) (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))) (XOR 1 f4 (XOR 1 a25 d25 f25 h25) (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))) (XOR 1 e25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)) (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3) (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))))))))) [bit:17] : (XOR 0 (XOR 1 a27 d27 f27 h27) (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16) (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)))) (XOR 1 f27 (XOR 1 a16 d16 f16 h16) (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))) (XOR 1 e16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)) (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26) (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))))) (XOR 1 h27 (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))) (XOR 1 e16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)) (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26) (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))))) (XOR 1 g16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26)) (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26) (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))) (XOR 1 f5 (XOR 1 a26 d26 f26 h26) (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))) (XOR 1 e26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)) (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4) (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))))))))) [bit:18] : (XOR 1 (XOR 1 a28 d28 f28 h28) (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17) (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)))) (XOR 1 f28 (XOR 1 a17 d17 f17 h17) (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))) (XOR 1 e17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)) (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27) (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))))) (XOR 1 h28 (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))) (XOR 1 e17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)) (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27) (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))))) (XOR 1 g17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27)) (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27) (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))) (XOR 0 f6 (XOR 1 a27 d27 f27 h27) (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))) (XOR 1 e27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)) (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5) (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))))))))) [bit:19] : (XOR 1 (XOR 0 a29 d29 f29 h29) (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18) (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))) (XOR 0 f29 (XOR 1 a18 d18 f18 h18) (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))) (XOR 1 e18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)) (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28) (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))))) (XOR 0 h29 (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28))) (XOR 1 e18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)) (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28) (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))))) (XOR 1 g18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)) (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28) (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))) (XOR 1 f7 (XOR 1 a28 d28 f28 h28) (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))) (XOR 1 e28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)) (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6) (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))))))))) [bit:20] : (XOR 0 (XOR 0 a30 d30 f30 h30) (XOR 0 d30 g30 (XOR 0 a19 d19 f19 h19) (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)))) (XOR 0 f30 (XOR 0 a19 d19 f19 h19) (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))) (XOR 0 e19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)) (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29) (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)))))) (XOR 0 h30 (XOR 0 c19 f19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29))) (XOR 0 e19 h19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)) (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29) (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))))) (XOR 0 g19 (XOR 1 b8 e8 g8 (XOR 0 a29 d29 f29 h29)) (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29) (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)))) (XOR 1 f8 (XOR 0 a29 d29 f29 h29) (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))) (XOR 0 e29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)) (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7) (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))))))))) [bit:21] : (XOR 0 (XOR 1 a31 d31 f31 h31) (XOR 1 d31 g31 (XOR 1 a20 d20 f20 h20) (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)))) (XOR 1 f31 (XOR 1 a20 d20 f20 h20) (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))) (XOR 1 e20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)) (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30) (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))))) (XOR 1 h31 (XOR 1 c20 f20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30))) (XOR 1 e20 h20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)) (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30) (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))))) (XOR 1 g20 (XOR 0 b9 e9 g9 (XOR 0 a30 d30 f30 h30)) (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30) (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))) (XOR 0 f9 (XOR 0 a30 d30 f30 h30) (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))) (XOR 0 e30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)) (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8) (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))))))))) [bit:22] : (XOR 1 (XOR 1 a0 d0 f0 h0) (XOR 0 d0 g0 (XOR 1 a21 d21 f21 h21) (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)))) (XOR 0 f0 (XOR 1 a21 d21 f21 h21) (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))) (XOR 1 e21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)) (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31) (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))))) (XOR 0 h0 (XOR 1 c21 f21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31))) (XOR 1 e21 h21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)) (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31) (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))))) (XOR 1 g21 (XOR 0 b10 e10 g10 (XOR 1 a31 d31 f31 h31)) (XOR 0 d10 g10 (XOR 1 a31 d31 f31 h31) (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)))) (XOR 0 f10 (XOR 1 a31 d31 f31 h31) (XOR 1 c31 f31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9))) (XOR 1 e31 h31 (XOR 1 b20 e20 g20 (XOR 0 a9 d9 f9 h9)) (XOR 1 d20 g20 (XOR 0 a9 d9 f9 h9) (XOR 0 c9 f9 h9 (XOR 0 b30 e30 g30 (XOR 0 a19 d19 f19 h19))))))))) [bit:23] : (XOR 1 (XOR 0 a1 d1 f1 h1) (XOR 1 d1 g1 (XOR 0 a22 d22 f22 h22) (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)))) (XOR 0 f1 (XOR 0 a22 d22 f22 h22) (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))) (XOR 0 e22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)) (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0) (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))))) (XOR 1 h1 (XOR 0 c22 f22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0))) (XOR 0 e22 h22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)) (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0) (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))))) (XOR 0 g22 (XOR 1 b11 e11 g11 (XOR 1 a0 d0 f0 h0)) (XOR 1 d11 g11 (XOR 1 a0 d0 f0 h0) (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)))) (XOR 1 f11 (XOR 1 a0 d0 f0 h0) (XOR 1 c0 f0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10))) (XOR 1 e0 h0 (XOR 1 b21 e21 g21 (XOR 0 a10 d10 f10 h10)) (XOR 1 d21 g21 (XOR 0 a10 d10 f10 h10) (XOR 0 c10 f10 h10 (XOR 1 b31 e31 g31 (XOR 1 a20 d20 f20 h20))))))))) [bit:24] : (XOR 1 (XOR 0 a2 d2 f2 h2) (XOR 0 d2 g2 (XOR 0 a23 d23 f23 h23) (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)))) (XOR 1 f2 (XOR 0 a23 d23 f23 h23) (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))) (XOR 0 e23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)) (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1) (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))))) (XOR 1 h2 (XOR 0 c23 f23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1))) (XOR 0 e23 h23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)) (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1) (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))))) (XOR 0 g23 (XOR 1 b12 e12 g12 (XOR 0 a1 d1 f1 h1)) (XOR 1 d12 g12 (XOR 0 a1 d1 f1 h1) (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)))) (XOR 1 f12 (XOR 0 a1 d1 f1 h1) (XOR 1 c1 f1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11))) (XOR 0 e1 h1 (XOR 0 b22 e22 g22 (XOR 1 a11 d11 f11 h11)) (XOR 0 d22 g22 (XOR 1 a11 d11 f11 h11) (XOR 1 c11 f11 h11 (XOR 0 b0 e0 g0 (XOR 1 a21 d21 f21 h21))))))))) [bit:25] : (XOR 1 (XOR 1 a3 d3 f3 h3) (XOR 1 d3 g3 (XOR 0 a24 d24 f24 h24) (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)))) (XOR 1 f3 (XOR 0 a24 d24 f24 h24) (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))) (XOR 0 e24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)) (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2) (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))))) (XOR 1 h3 (XOR 0 c24 f24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2))) (XOR 0 e24 h24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)) (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2) (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))))) (XOR 0 g24 (XOR 1 b13 e13 g13 (XOR 0 a2 d2 f2 h2)) (XOR 1 d13 g13 (XOR 0 a2 d2 f2 h2) (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)))) (XOR 1 f13 (XOR 0 a2 d2 f2 h2) (XOR 0 c2 f2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12))) (XOR 1 e2 h2 (XOR 0 b23 e23 g23 (XOR 1 a12 d12 f12 h12)) (XOR 0 d23 g23 (XOR 1 a12 d12 f12 h12) (XOR 1 c12 f12 h12 (XOR 0 b1 e1 g1 (XOR 0 a22 d22 f22 h22))))))))) [bit:26] : (XOR 0 (XOR 1 a4 d4 f4 h4) (XOR 1 d4 g4 (XOR 1 a25 d25 f25 h25) (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)))) (XOR 1 f4 (XOR 1 a25 d25 f25 h25) (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))) (XOR 1 e25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)) (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3) (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))))) (XOR 1 h4 (XOR 1 c25 f25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3))) (XOR 1 e25 h25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)) (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3) (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))))) (XOR 1 g25 (XOR 1 b14 e14 g14 (XOR 1 a3 d3 f3 h3)) (XOR 1 d14 g14 (XOR 1 a3 d3 f3 h3) (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)))) (XOR 1 f14 (XOR 1 a3 d3 f3 h3) (XOR 1 c3 f3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13))) (XOR 1 e3 h3 (XOR 0 b24 e24 g24 (XOR 1 a13 d13 f13 h13)) (XOR 0 d24 g24 (XOR 1 a13 d13 f13 h13) (XOR 1 c13 f13 h13 (XOR 0 b2 e2 g2 (XOR 0 a23 d23 f23 h23))))))))) [bit:27] : (XOR 1 (XOR 1 a5 d5 f5 h5) (XOR 1 d5 g5 (XOR 1 a26 d26 f26 h26) (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)))) (XOR 1 f5 (XOR 1 a26 d26 f26 h26) (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))) (XOR 1 e26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)) (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4) (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))))) (XOR 1 h5 (XOR 1 c26 f26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4))) (XOR 1 e26 h26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)) (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4) (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))))) (XOR 1 g26 (XOR 0 b15 e15 g15 (XOR 1 a4 d4 f4 h4)) (XOR 0 d15 g15 (XOR 1 a4 d4 f4 h4) (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)))) (XOR 0 f15 (XOR 1 a4 d4 f4 h4) (XOR 1 c4 f4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14))) (XOR 1 e4 h4 (XOR 1 b25 e25 g25 (XOR 1 a14 d14 f14 h14)) (XOR 1 d25 g25 (XOR 1 a14 d14 f14 h14) (XOR 1 c14 f14 h14 (XOR 1 b3 e3 g3 (XOR 0 a24 d24 f24 h24))))))))) [bit:28] : (XOR 1 (XOR 0 a6 d6 f6 h6) (XOR 0 d6 g6 (XOR 1 a27 d27 f27 h27) (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)))) (XOR 0 f6 (XOR 1 a27 d27 f27 h27) (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))) (XOR 1 e27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)) (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5) (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))))) (XOR 0 h6 (XOR 1 c27 f27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5))) (XOR 1 e27 h27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)) (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5) (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))))) (XOR 1 g27 (XOR 1 b16 e16 g16 (XOR 1 a5 d5 f5 h5)) (XOR 1 d16 g16 (XOR 1 a5 d5 f5 h5) (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)))) (XOR 1 f16 (XOR 1 a5 d5 f5 h5) (XOR 1 c5 f5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15))) (XOR 1 e5 h5 (XOR 1 b26 e26 g26 (XOR 0 a15 d15 f15 h15)) (XOR 1 d26 g26 (XOR 0 a15 d15 f15 h15) (XOR 0 c15 f15 h15 (XOR 1 b4 e4 g4 (XOR 1 a25 d25 f25 h25))))))))) [bit:29] : (XOR 1 (XOR 1 a7 d7 f7 h7) (XOR 1 d7 g7 (XOR 1 a28 d28 f28 h28) (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)))) (XOR 1 f7 (XOR 1 a28 d28 f28 h28) (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))) (XOR 1 e28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)) (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6) (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))))) (XOR 1 h7 (XOR 1 c28 f28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6))) (XOR 1 e28 h28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)) (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6) (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))))) (XOR 1 g28 (XOR 1 b17 e17 g17 (XOR 0 a6 d6 f6 h6)) (XOR 1 d17 g17 (XOR 0 a6 d6 f6 h6) (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)))) (XOR 1 f17 (XOR 0 a6 d6 f6 h6) (XOR 0 c6 f6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16))) (XOR 0 e6 h6 (XOR 1 b27 e27 g27 (XOR 1 a16 d16 f16 h16)) (XOR 1 d27 g27 (XOR 1 a16 d16 f16 h16) (XOR 1 c16 f16 h16 (XOR 1 b5 e5 g5 (XOR 1 a26 d26 f26 h26))))))))) [bit:30] : (XOR 0 (XOR 1 a8 d8 f8 h8) (XOR 1 d8 g8 (XOR 0 a29 d29 f29 h29) (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)))) (XOR 1 f8 (XOR 0 a29 d29 f29 h29) (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))) (XOR 0 e29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)) (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7) (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))))) (XOR 1 h8 (XOR 0 c29 f29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7))) (XOR 0 e29 h29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)) (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7) (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))))) (XOR 0 g29 (XOR 1 b18 e18 g18 (XOR 1 a7 d7 f7 h7)) (XOR 1 d18 g18 (XOR 1 a7 d7 f7 h7) (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)))) (XOR 1 f18 (XOR 1 a7 d7 f7 h7) (XOR 1 c7 f7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17))) (XOR 1 e7 h7 (XOR 1 b28 e28 g28 (XOR 1 a17 d17 f17 h17)) (XOR 1 d28 g28 (XOR 1 a17 d17 f17 h17) (XOR 1 c17 f17 h17 (XOR 0 b6 e6 g6 (XOR 1 a27 d27 f27 h27))))))))) [bit:31] : (XOR 1 (XOR 0 a9 d9 f9 h9) (XOR 0 d9 g9 (XOR 0 a30 d30 f30 h30) (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)))) (XOR 0 f9 (XOR 0 a30 d30 f30 h30) (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))) (XOR 0 e30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)) (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8) (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))))) (XOR 0 h9 (XOR 0 c30 f30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8))) (XOR 0 e30 h30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)) (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8) (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))))) (XOR 0 g30 (XOR 0 b19 e19 g19 (XOR 1 a8 d8 f8 h8)) (XOR 0 d19 g19 (XOR 1 a8 d8 f8 h8) (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)))) (XOR 0 f19 (XOR 1 a8 d8 f8 h8) (XOR 1 c8 f8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18))) (XOR 1 e8 h8 (XOR 0 b29 e29 g29 (XOR 1 a18 d18 f18 h18)) (XOR 0 d29 g29 (XOR 1 a18 d18 f18 h18) (XOR 1 c18 f18 h18 (XOR 1 b7 e7 g7 (XOR 1 a28 d28 f28 h28)))))))))```

Still needs an elementary term-combining algebraic simplifier. Then, potentially we learn the answer to the puzzler of whether there are in fact 2**256 possible 528-byte expanded keys.

~To be continued!~

## Serpent in ICE40, Part 2.

Below is a revision of the forward S-box of Serpent from the previous article, with all of the S-Box equations rewritten in the same form, i.e. using strictly AND, OR, and NOT operations, with none having more than six subclauses, and reformatted for clarity:

```module sbox_forward(clk, fire, box_n, a, b, c, d, w, x, y, z); // clock input wire clk;   // trigger input wire fire;   // number of sbox input [3:0] box_n;   // inputs input [31:0] a; input [31:0] b; input [31:0] c; input [31:0] d;   // outputs output reg [31:0] w = 0; output reg [31:0] x = 0; output reg [31:0] y = 0; output reg [31:0] z = 0;   always @(posedge clk) if (fire) begin begin case (box_n) ///////////////////////////////// 4'd0: begin w < = ( a & ~b & ~c & d) | (~a & c & d) | (~a & ~c & ~d) | ( b & ~d);   x <= ( a & b & ~c & d) | ( a & c & ~d) | (~a & ~b ) | (~a & ~c & ~d);   y <= ( a & b & c & d) | ( a & ~b & c & ~d) | (~a & b & ~d) | (~a & ~b & d) | (~a & ~c & d) | ( ~b & ~c & d);   z <= ( a & b & c ) | ( a & ~b & ~c ) | (~a & b & ~c & ~d) | (~a & ~b & c & ~d) | ( b & c & d) | ( ~b & ~c & d); end ///////////////////////////////// 4'd1: begin w <= ( a & b & ~c & ~d) | ( a & ~b & d) | (~a & b & c ) | (~a & ~b & ~c ) | (~a & ~b & ~d);   x <= ( a & b & ~d) | ( a & ~b & ~c & d) | (~a & b & d) | (~a & c & d) | (~a & ~c & ~d);   y <= ( a & c & d) | ( a & ~c & ~d) | (~a & b & c & ~d) | (~a & b & ~c & d) | ( ~b & c & d) | ( ~b & ~c & ~d);   z <= ( a & b & c & ~d) | ( a & ~b & d) | (~a & ~b & ~d) | ( b & ~c & d) | ( ~b & ~c & ~d); end ///////////////////////////////// 4'd2: begin w <= ( a & b & ~d) | ( a & ~b & d) | (~a & b & c & d) | (~a & ~b & c & ~d) | ( b & ~c & ~d) | ( ~b & ~c & d);   x <= ( a & ~b & ~c & ~d) | ( a & c & d) | (~a & b & ~c ) | (~a & c & ~d) | ( b & c & ~d);   y <= ( a & ~b & ~d) | ( a & c & ~d) | (~a & b & ~c ) | (~a & b & d) | (~a & ~c & d) | ( b & ~c & d);   z <= ( a & b & ~d) | ( a & ~b & c ) | (~a & ~b & ~c ) | (~a & ~c & d) | ( b & c & ~d); end ///////////////////////////////// 4'd3: begin w <= ( a & ~b ) | ( a & c & ~d) | (~a & b & c & d) | (~a & b & ~c & ~d) | ( ~b & ~c & d);   x <= ( a & b & c ) | ( a & ~b & ~c & ~d) | (~a & b & ~c ) | ( b & c & ~d) | ( ~b & c & d);   y <= ( a & b & d) | ( a & ~b & ~c & ~d) | ( a & c & d) | (~a & b & c ) | (~a & ~b & ~c & d) | (~a & c & ~d);   z <= ( a & b & c & d) | ( a & ~b & ~d) | (~a & ~b & d) | ( b & ~c & ~d) | ( ~b & c & ~d); end ///////////////////////////////// 4'd4: begin w <= ( a & ~b & ~c ) | ( a & ~c & ~d) | (~a & b & c ) | (~a & c & d) | ( b & c & d) | ( ~b & ~c & ~d);   x <= ( a & b & ~c ) | ( a & ~b & c & d) | ( a & ~c & ~d) | (~a & b & c ) | (~a & ~b & ~c & d) | ( b & c & ~d);   y <= ( a & b & c ) | ( a & ~b & ~c ) | ( a & ~b & d) | (~a & b & d) | (~a & ~b & c & ~d);   z <= ( a & b & d) | ( a & ~b & ~c & ~d) | (~a & b & ~d) | (~a & ~b & c ) | ( ~b & c & d);   end ///////////////////////////////// 4'd5: begin w <= ( a & ~b & ~c ) | ( a & ~c & ~d) | (~a & b & c ) | (~a & c & d) | ( b & c & d) | ( ~b & ~c & ~d);   x <= ( a & ~b & c ) | ( a & ~b & d) | (~a & b & d) | (~a & ~c & ~d) | ( b & ~c & ~d);   y <= ( a & b & c & ~d) | (~a & b & d) | (~a & ~b & c ) | ( ~b & c & d) | ( ~b & ~c & ~d);   z <= ( a & b & ~c ) | ( a & c & ~d) | (~a & ~b & c & d) | (~a & ~b & ~c & ~d) | ( b & c & ~d) | ( b & ~c & d); end ///////////////////////////////// 4'd6: begin w <= ( a & b & ~d) | ( a & ~c & d) | (~a & ~b & ~c & ~d) | ( b & ~c & d) | ( ~b & c & d);   x <= ( a & b & ~c & d) | ( a & ~b & c & d) | (~a & b & c ) | (~a & ~b & ~c ) | ( b & c & ~d) | ( ~b & ~c & ~d);   y <= ( a & b & ~c ) | ( a & ~b & c & ~d) | (~a & b & ~d) | (~a & ~b & ~c ) | (~a & ~b & d);   z <= ( a & b & c & ~d) | ( a & ~c & d) | (~a & b & ~c & ~d) | (~a & ~b & c ) | (~a & c & d) | ( ~b & ~c & d); end ///////////////////////////////// 4'd7: begin w <= ( a & b & c & ~d) | (~a & ~b & ~c ) | (~a & c & d) | (~a & ~c & ~d) | ( ~b & c & d) | ( ~b & ~c & ~d);   x <= ( a & b & c ) | ( a & b & d) | ( a & c & d) | (~a & b & ~d) | (~a & ~b & ~c & d) | (~a & c & ~d);   y <= ( a & ~b & ~c ) | (~a & b & ~c ) | (~a & ~b & c & ~d) | (~a & ~c & d) | ( b & c & d);   z <= ( a & ~b & ~d) | ( a & c & ~d) | (~a & b & ~c ) | (~a & ~b & c ) | ( b & ~c & d);   end ///////////////////////////////// endcase // case (box_n) end end endmodule```

This formulation produces the same test output as previously noted.

Potentially this will make it possible to determine a more compact circuit representation (e.g. one making use of a RAM table populated with constants, on top of a MUX).

~To be continued!~

## Can the Serpent Cipher fit in the ICE40 FPGA?

The question of whether the Serpent cipher could fit in a ICE40 FPGA was posed recently, and my first thought was: why not bake what appears to be the heaviest moving part, and see how many gates it requires? Then it will be possible to estimate whether the entire thing is worth baking. (I have very little interest in using again any FPGA other than ICE40, unless another reversing breakthrough, concerning a larger chip, is made public.)

And so I took the forward S-box of Serpent and came up with the following:

```module sbox_forward(clk, fire, box_n, a, b, c, d, w, x, y, z); // clock input wire clk;   // trigger input wire fire;   // number of sbox input [3:0] box_n;   // inputs input [31:0] a; input [31:0] b; input [31:0] c; input [31:0] d;   // outputs output reg [31:0] w = 0; output reg [31:0] x = 0; output reg [31:0] y = 0; output reg [31:0] z = 0;   always @(posedge clk) if (fire) begin begin case (box_n) ///////////////////////////////// 4'd0: begin w < = ( a & ~b & ~c & d) | (~a & c & d) | (~a & ~c & ~d) | ( b & ~d);   x <= ( a & b & ~c & d) | ( a & c & ~d) | (~a & ~b) | (~a & ~c & ~d);   y <= ((~b | c) & d) ^ ((a ^ b) & (b | c));   z <= b ^ c ^ (a | d); end ///////////////////////////////// 4'd1: begin w <= ( a & b & ~c & ~d) | ( a & ~b & d) | (~a & b & c) | (~a & ~b & ~c) | (~a & ~b & ~d);   x <= ( a & b & ~d) | ( a & ~b & ~c & d) | (~a & b & d) | (~a & c & d) | (~a & ~c & ~d);   y <= c ^ d ^ (a | ~b);   z <= ( a & b & c & ~d) | ( a & ~b & d) | (~a & ~b & ~d) | ( b & ~c & d) | ( ~b & ~c & ~d); end ///////////////////////////////// 4'd2: begin w <= a ^ b ^ d ^ (a | c);   x <= ( a & ~b & ~c & ~d) | ( a & c & d) | (~a & b & ~c) | (~a & c & ~d) | ( b & c & ~d);   y <= ( a & ~b & ~d) | ( a & c & ~d) | (~a & b & ~c) | (~a & b & d) | (~a & ~c & d) | ( b & ~c & d);   z <= ( a & b & ~d) | ( a & ~b & c) | (~a & ~b & ~c) | (~a & ~c & d) | ( b & c & ~d); end ///////////////////////////////// 4'd3: begin w <= ( a & ~b) | ( a & c & ~d) | (~a & b & c & d) | (~a & b & ~c & ~d) | ( ~b & ~c & d);   x <= ( a & b & c) | ( a & ~b & ~c & ~d) | (~a & b & ~c) | ( b & c & ~d) | (~b & c & d);   y <= ( a & b & d) | ( a & ~b & ~c & ~d) | ( a & c & d) | (~a & b & c) | (~a & ~b & ~c & d) | (~a & c & ~d);   z <= ( a & b & c & d) | ( a & ~b & ~d) | (~a & ~b & d) | ( b & ~c & ~d) | ( ~b & c & ~d); end ///////////////////////////////// 4'd4: begin w <= ( a & ~b & ~c) | ( a & ~c & ~d) | (~a & b & c) | (~a & c & d) | ( b & c & d) | ( ~b & ~c & ~d);   x <= ( a & b & ~c) | ( a & ~b & c & d) | ( a & ~c & ~d) | (~a & b & c) | (~a & ~b & ~c & d) | ( b & c & ~d);   y <= ( a & b & c) | ( a & ~b & ~c) | ( a & ~b & d) | (~a & b & d) | (~a & ~b & c & ~d);   z <= a ^ (d & (a | b)) ^ (b | c); end ///////////////////////////////// 4'd5: begin w <= ( a & ~b & ~c) | ( a & ~c & ~d) | (~a & b & c) | (~a & c & d) | ( b & c & d) | (~b & ~c & ~d);   x <= ( a & ~b & c) | ( a & ~b & d) | (~a & b & d) | (~a & ~c & ~d) | ( b & ~c & ~d);   y <= ( a & b & c & ~d) | (~a & b & d) | (~a & ~b & c) | ( ~b & c & d) | ( ~b & ~c & ~d);   z <= ( a & b & ~c) | ( a & c & ~d) | (~a & ~b & c & d) | (~a & ~b & ~c & ~d) | ( b & c & ~d) | ( b & ~c & d); end ///////////////////////////////// 4'd6: begin w <= ( a & b & ~d) | ( a & ~c & d) | (~a & ~b & ~c & ~d) | ( b & ~c & d) | ( ~b & c & d);   x <= ~(b ^ c ^ (a & d));   y <= ( a & b & ~c) | ( a & ~b & c & ~d) | (~a & b & ~d) | (~a & ~b & ~c) | (~a & ~b & d);   z <= ( a & b & c & ~d) | ( a & ~c & d) | (~a & b & ~c & ~d) | (~a & ~b & c) | (~a & c & d) | ( ~b & ~c & d); end ///////////////////////////////// 4'd7: begin w <= ( a & b & c & ~d) | (~a & ~b & ~c) | (~a & c & d) | (~a & ~c & ~d) | ( ~b & c & d) | ( ~b & ~c & ~d);   x <= ( a & b & c) | ( a & b & d) | ( a & c & d) | (~a & b & ~d) | (~a & ~b & ~c & d) | (~a & c & ~d);   y <= ( a & ~b & ~c) | (~a & b & ~c) | (~a & ~b & c & ~d) | (~a & ~c & d) | ( b & c & d);   z <= c ^ (a & ~d) ^ (b | (a & c)); end ///////////////////////////////// endcase // case (box_n) end end endmodule```

And a simple “smoke test”:

````timescale 1ns/100ps   `include "sbox.v"     module serpent_sbox_tester; reg clk = 0;   // firing signal reg f = 0;   // box # reg [3:0] box_n = 0;   // inputs reg [31:0] a = 0; reg [31:0] b = 0; reg [31:0] c = 0; reg [31:0] d = 0;   // outputs wire [31:0] w; wire [31:0] x; wire [31:0] y; wire [31:0] z;   // serpent 'forward' sbox sbox_forward sbf(.clk(clk), .fire(f), .box_n(box_n), .a(a), .b(b), .c(c), .d(d), .w(w), .x(x), .y(y), .z(z));   // clockator always begin clk = 1'b1; #1; clk = 1'b0; #1; end   initial begin: Init   #0 \$display ("Started...\n");   #0 a = 32'hDEADF00D; #0 b = 32'hC0DEDBAD; #0 c = 32'hCAFEBABE; #0 d = 32'hBADCAFED;   // display inputs \$display ("a = %h b = %h c = %h d = %h", a, b, c, d); #1 f = 1;   // sbox 0: #1 box_n = 0; \$display ("box_n = %h", box_n); #2; \$display ("w = %h x = %h y = %h z = %h", w, x, y, z);   // sbox 1: #3 box_n = 1; \$display ("box_n = %h", box_n); #4; \$display ("w = %h x = %h y = %h z = %h", w, x, y, z);   // sbox 2: #5 box_n = 2; \$display ("box_n = %h", box_n); #6; \$display ("w = %h x = %h y = %h z = %h", w, x, y, z);   // sbox 3: #7 box_n = 3; \$display ("box_n = %h", box_n); #8; \$display ("w = %h x = %h y = %h z = %h", w, x, y, z);   // sbox 4: #9 box_n = 4; \$display ("box_n = %h", box_n); #10; \$display ("w = %h x = %h y = %h z = %h", w, x, y, z);   // sbox 5: #11 box_n = 5; \$display ("box_n = %h", box_n); #12; \$display ("w = %h x = %h y = %h z = %h", w, x, y, z);   // sbox 6: #13 box_n = 6; \$display ("box_n = %h", box_n); #14; \$display ("w = %h x = %h y = %h z = %h", w, x, y, z);   // sbox 7: #15 box_n = 7; \$display ("box_n = %h", box_n); #16; \$display ("w = %h x = %h y = %h z = %h", w, x, y, z);   \$display ("Finish.\n"); \$finish; end // block: Init   endmodule```
```# Project Name PROJ=small   # Simulator testbench BENCH=tester   sim: iverilog -v \$(BENCH).v -o \$(PROJ)sim```
```make ./smallsim```

... produced the following output:

```a = deadf00d b = c0dedbad c = cafebabe d = badcafed box_n = 0 w = 51525aa0 x = 61201453 y = b0ae854c z = f4dd9efe box_n = 1 w = 3b526ef2 x = 51505ba0 y = 8f8fe10c z = 5f013113 box_n = 2 w = 7a507ef2 x = ce8fb11e y = 64711fe1 z = 6b227540 box_n = 3 w = 7e713ee0 x = ce8fb10c y = aedfaeff z = a4adc45e box_n = 4 w = 95dfcaac x = 6e537ee1 y = deddbbbe z = 8e8fa01f box_n = 5 w = 95dfcaac x = 1b706ba0 y = 4f513bb2 z = 41225101 box_n = 6 w = 5b007101 x = 6f533ee1 y = 21224441 z = 70501ef3 box_n = 7 w = 6f513ee0 x = ea8eb45f y = b4dd8ffe z = 44211113 Finish.```

Let's quickly verify, using a section of the ancient C source for Serpent:

``` #define u32 uint32_t   #define SBOX0(a, b, c, d, w, x, y, z) \ { \ u32 t02, t03, t05, t06, t07, t08, t09; \ u32 t11, t12, t13, t14, t15, t17, t01; \ t01 = b ^ c ; \ t02 = a | d ; \ t03 = a ^ b ; \ z = t02 ^ t01; \ t05 = c | z ; \ t06 = a ^ d ; \ t07 = b | c ; \ t08 = d & t05; \ t09 = t03 & t07; \ y = t09 ^ t08; \ t11 = t09 & y ; \ t12 = c ^ d ; \ t13 = t07 ^ t11; \ t14 = b & t06; \ t15 = t06 ^ t13; \ w = ~ t15; \ t17 = w ^ t14; \ x = t12 ^ t17; \ }   #define SBOX1(a, b, c, d, w, x, y, z) \ { \ u32 t02, t03, t04, t05, t06, t07, t08; \ u32 t10, t11, t12, t13, t16, t17, t01; \ t01 = a | d ; \ t02 = c ^ d ; \ t03 = ~ b ; \ t04 = a ^ c ; \ t05 = a | t03; \ t06 = d & t04; \ t07 = t01 & t02; \ t08 = b | t06; \ y = t02 ^ t05; \ t10 = t07 ^ t08; \ t11 = t01 ^ t10; \ t12 = y ^ t11; \ t13 = b & d ; \ z = ~ t10; \ x = t13 ^ t12; \ t16 = t10 | x ; \ t17 = t05 & t16; \ w = c ^ t17; \ }   #define SBOX2(a, b, c, d, w, x, y, z) \ { \ u32 t02, t03, t05, t06, t07, t08; \ u32 t09, t10, t12, t13, t14, t01; \ t01 = a | c ; \ t02 = a ^ b ; \ t03 = d ^ t01; \ w = t02 ^ t03; \ t05 = c ^ w ; \ t06 = b ^ t05; \ t07 = b | t05; \ t08 = t01 & t06; \ t09 = t03 ^ t07; \ t10 = t02 | t09; \ x = t10 ^ t08; \ t12 = a | d ; \ t13 = t09 ^ x ; \ t14 = b ^ t13; \ z = ~ t09; \ y = t12 ^ t14; \ }   #define SBOX3(a, b, c, d, w, x, y, z) \ { \ u32 t02, t03, t04, t05, t06, t07, t08; \ u32 t09, t10, t11, t13, t14, t15, t01; \ t01 = a ^ c ; \ t02 = a | d ; \ t03 = a & d ; \ t04 = t01 & t02; \ t05 = b | t03; \ t06 = a & b ; \ t07 = d ^ t04; \ t08 = c | t06; \ t09 = b ^ t07; \ t10 = d & t05; \ t11 = t02 ^ t10; \ z = t08 ^ t09; \ t13 = d | z ; \ t14 = a | t07; \ t15 = b & t13; \ y = t08 ^ t11; \ w = t14 ^ t15; \ x = t05 ^ t04; \ }   #define SBOX4(a, b, c, d, w, x, y, z) \ { \ u32 t02, t03, t04, t05, t06, t08, t09; \ u32 t10, t11, t12, t13, t14, t15, t16, t01; \ t01 = a | b ; \ t02 = b | c ; \ t03 = a ^ t02; \ t04 = b ^ d ; \ t05 = d | t03; \ t06 = d & t01; \ z = t03 ^ t06; \ t08 = z & t04; \ t09 = t04 & t05; \ t10 = c ^ t06; \ t11 = b & c ; \ t12 = t04 ^ t08; \ t13 = t11 | t03; \ t14 = t10 ^ t09; \ t15 = a & t05; \ t16 = t11 | t12; \ y = t13 ^ t08; \ x = t15 ^ t16; \ w = ~ t14; \ }   #define SBOX5(a, b, c, d, w, x, y, z) \ { \ u32 t02, t03, t04, t05, t07, t08, t09; \ u32 t10, t11, t12, t13, t14, t01; \ t01 = b ^ d ; \ t02 = b | d ; \ t03 = a & t01; \ t04 = c ^ t02; \ t05 = t03 ^ t04; \ w = ~ t05; \ t07 = a ^ t01; \ t08 = d | w ; \ t09 = b | t05; \ t10 = d ^ t08; \ t11 = b | t07; \ t12 = t03 | w ; \ t13 = t07 | t10; \ t14 = t01 ^ t11; \ y = t09 ^ t13; \ x = t07 ^ t08; \ z = t12 ^ t14; \ }   #define SBOX6(a, b, c, d, w, x, y, z) \ { \ u32 t02, t03, t04, t05, t07, t08, t09, t10; \ u32 t11, t12, t13, t15, t17, t18, t01; \ t01 = a & d ; \ t02 = b ^ c ; \ t03 = a ^ d ; \ t04 = t01 ^ t02; \ t05 = b | c ; \ x = ~ t04; \ t07 = t03 & t05; \ t08 = b & x ; \ t09 = a | c ; \ t10 = t07 ^ t08; \ t11 = b | d ; \ t12 = c ^ t11; \ t13 = t09 ^ t10; \ y = ~ t13; \ t15 = x & t03; \ z = t12 ^ t07; \ t17 = a ^ b ; \ t18 = y ^ t15; \ w = t17 ^ t18; \ }   #define SBOX7(a, b, c, d, w, x, y, z) \ { \ u32 t02, t03, t04, t05, t06, t08, t09, t10; \ u32 t11, t13, t14, t15, t16, t17, t01; \ t01 = a & c ; \ t02 = ~ d ; \ t03 = a & t02; \ t04 = b | t01; \ t05 = a & b ; \ t06 = c ^ t04; \ z = t03 ^ t06; \ t08 = c | z ; \ t09 = d | t05; \ t10 = a ^ t08; \ t11 = t04 & z ; \ x = t09 ^ t10; \ t13 = b ^ x ; \ t14 = t01 ^ x ; \ t15 = c ^ t05; \ t16 = t11 | t13; \ t17 = t02 | t14; \ w = t15 ^ t17; \ y = a ^ t16; \ }   uint32_t a = 0xDEADF00D; uint32_t b = 0xC0DEDBAD; uint32_t c = 0xCAFEBABE; uint32_t d = 0xBADCAFED;   uint32_t w = 0, x = 0, y = 0, z = 0;   void clear() { w = 0; x = 0; y = 0; z = 0; }   void dump_ins() { printf("a = 0x%08x b = 0x%08x c = 0x%08x d = 0x%08x\n", a, b, c, d); }   void dump_outs() { printf("w = 0x%08x x = 0x%08x y = 0x%08x z = 0x%08x\n", w, x, y, z); }     void main() {   dump_ins();   printf("SBOX0:\n"); clear(); SBOX0(a, b, c, d, w, x, y, z); dump_outs();   printf("SBOX1:\n"); clear(); SBOX1(a, b, c, d, w, x, y, z); dump_outs();   printf("SBOX2:\n"); clear(); SBOX2(a, b, c, d, w, x, y, z); dump_outs();   printf("SBOX3:\n"); clear(); SBOX3(a, b, c, d, w, x, y, z); dump_outs();   printf("SBOX4:\n"); clear(); SBOX4(a, b, c, d, w, x, y, z); dump_outs();   printf("SBOX5:\n"); clear(); SBOX5(a, b, c, d, w, x, y, z); dump_outs();   printf("SBOX6:\n"); clear(); SBOX6(a, b, c, d, w, x, y, z); dump_outs();   printf("SBOX7:\n"); clear(); SBOX7(a, b, c, d, w, x, y, z); dump_outs();   }```

The latter spits out:

```a = 0xdeadf00d b = 0xc0dedbad c = 0xcafebabe d = 0xbadcafed SBOX0: w = 0x51525aa0 x = 0x61201453 y = 0xb0ae854c z = 0xf4dd9efe SBOX1: w = 0x3b526ef2 x = 0x51505ba0 y = 0x8f8fe10c z = 0x5f013113 SBOX2: w = 0x7a507ef2 x = 0xce8fb11e y = 0x64711fe1 z = 0x6b227540 SBOX3: w = 0x7e713ee0 x = 0xce8fb10c y = 0xaedfaeff z = 0xa4adc45e SBOX4: w = 0x95dfcaac x = 0x6e537ee1 y = 0xdeddbbbe z = 0x8e8fa01f SBOX5: w = 0x95dfcaac x = 0x1b706ba0 y = 0x4f513bb2 z = 0x41225101 SBOX6: w = 0x5b007101 x = 0x6f533ee1 y = 0x21224441 z = 0x70501ef3 SBOX7: w = 0x6f513ee0 x = 0xea8eb45f y = 0xb4dd8ffe z = 0x44211113```

I.e. a matching set, for the particular input.

Not a proof of correctness, by any means, but we do learn that there is no obvious mistake.

The next logical step of the experiment would be to put the forward S-box component into an ICE40 and see precisely how many gates it occupies. Then can multiply this by two (there is also an inverse S-Box, and see whether it makes sense to attempt to produce the rest of the mechanism. The 32kB of block RAM available on the largest ICE40, theoretically suffices for Serpent's key schedule and other required buffers. But does the gate count?

~To be continued!~